﻿Event[0]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-16T11:26:52.0570000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name t-ring-fallbacks2.msedge.net timed out after none of the configured DNS servers responded. Client PID 8428. 

Event[1]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-16T11:27:03.1590000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name t-ring-fallbacks2.msedge.net timed out after none of the configured DNS servers responded. Client PID 8428. 

Event[2]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T11:30:41.2830000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[3]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T11:33:01.5500000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4]
  Log Name: System
  Source: Tcpip
  Date: 2025-09-16T12:01:03.7430000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[5]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T12:30:52.0740000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[6]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T12:33:12.3440000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[7]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-16T12:57:31.8840000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[8]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-16T13:05:19.2460000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[9]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-16T13:05:49.7630000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[10]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-16T13:09:42.3760000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name t-ring-fdv2.msedge.net timed out after none of the configured DNS servers responded. Client PID 8428. 

Event[11]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-16T13:46:15.0820000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[12]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T13:46:34.1950000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[13]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T13:46:34.1950000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?09?-?16T09:46:34.194795900Z from ?2025?-?09?-?16T09:46:30.549105500Z.
Time Delta: 3645 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 18256).

RTC time: ?2025?-?09?-?16T15:16:34.194795900Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[14]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-16T13:46:34.1950000Z
  Event ID: 35
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time service is now synchronizing the system time with the time source time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123) with reference id 3611644667. Current local stratum number is 4. 

Event[15]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T13:46:34.1960000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[16]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T13:46:34.1960000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?09?-?16T09:46:34.196084200Z from ?2025?-?09?-?16T09:46:34.194795900Z.
Time Delta: 1 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 18256).

RTC time: ?2025?-?09?-?16T15:16:34.196084200Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[17]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T13:46:34.1970000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[18]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T13:46:34.1970000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?09?-?16T09:46:34.197550000Z from ?2025?-?09?-?16T09:46:34.196084200Z.
Time Delta: 1 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 18256).

RTC time: ?2025?-?09?-?16T15:16:34.197550000Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[19]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-16T14:28:56.9030000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name www.google.com timed out after none of the configured DNS servers responded. Client PID 10436. 

Event[20]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-16T14:29:36.9820000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name bolt.dropbox.com timed out after none of the configured DNS servers responded. Client PID 10436. 

Event[21]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-16T14:29:46.0570000Z
  Event ID: 4003
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig detected limited connectivity, attempting automatic recovery.

Recovery Type: 4
Error Code: 0x0
Trigger Reason: 1
IP Family: 0
 

Event[22]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-16T14:29:46.2180000Z
  Event ID: 8000
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
8000 - Miniport Halt flow (driver disable) 

Event[23]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-16T14:29:46.9740000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP18 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[24]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-16T14:29:47.0530000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[25]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-16T14:29:47.0780000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[26]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-16T14:29:47.1620000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[27]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-16T14:46:46.1360000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[28]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-16T14:49:10.1600000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[29]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-16T14:52:33.0520000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[30]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-16T14:55:09.7030000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[31]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-16T15:06:08.5870000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[32]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T15:15:40.2970000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  Dropbox Update Service (dbupdate)
Service File Name:  "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc
Service Type:  user mode service
Service Start Type:  auto start
Service Account:  LocalSystem 

Event[33]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T15:15:40.3130000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  Dropbox Update Service (dbupdatem)
Service File Name:  "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /medsvc
Service Type:  user mode service
Service Start Type:  demand start
Service Account:  LocalSystem 

Event[34]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T15:15:44.7120000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[35]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T15:19:11.4530000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  Dropbox Elevation Service (DropboxElevationService)
Service File Name:  "C:\Program Files (x86)\Dropbox\Client\232.4.5988\DropboxElevationService.exe" --svc --appid={cc46080e-4c33-4981-859a-bba2f780f31e}
Service Type:  user mode service
Service Start Type:  demand start
Service Account:  LocalSystem 

Event[36]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T15:19:12.0550000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  DbxSvc
Service File Name:  %SystemRoot%\System32\DbxSvc.exe
Service Type:  user mode service
Service Start Type:  auto start
Service Account:  LocalSystem 

Event[37]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-16T15:20:46.7270000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[38]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-16T15:24:22.5060000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name t-ring-fdv2.msedge.net timed out after none of the configured DNS servers responded. Client PID 22680. 

Event[39]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T15:26:10.8160000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  DropboxUpdater InternalService 123.0.6299.129 (DropboxUpdaterInternalService123.0.6299.129)
Service File Name:  "C:\Program Files\Dropbox\DropboxUpdater\123.0.6299.129\updater.exe" --system --windows-service --service=update-internal --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2
Service Type:  user mode service
Service Start Type:  auto start
Service Account:  LocalSystem 

Event[40]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-16T15:26:22.5030000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[41]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T15:26:23.7010000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Intel(R) Content Protection HECI Service service terminated with the following error: 
Unspecified error 

Event[42]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T15:28:36.3190000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  dbx
Service File Name:  system32\DRIVERS\dbx.sys
Service Type:  kernel mode driver
Service Start Type:  demand start
Service Account:   

Event[43]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T15:28:36.4060000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[44]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T15:31:11.1630000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  DropboxUpdater Service 123.0.6299.129 (DropboxUpdaterService123.0.6299.129)
Service File Name:  "C:\Program Files\Dropbox\DropboxUpdater\123.0.6299.129\updater.exe" --system --windows-service --service=update --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/updater/*=2
Service Type:  user mode service
Service Start Type:  auto start
Service Account:  LocalSystem 

Event[45]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-16T15:41:14.2290000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name variations.brave.com timed out after none of the configured DNS servers responded. Client PID 10436. 

Event[46]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-16T15:53:13.8410000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name client.dropbox.com timed out after none of the configured DNS servers responded. Client PID 25280. 

Event[47]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-16T15:56:42.9070000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name cfl.dropboxstatic.com timed out after none of the configured DNS servers responded. Client PID 10436. 

Event[48]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T16:10:53.3770000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[49]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T16:11:08.4390000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 0 to 1.

Reason SessionUnlock 

BootId: 9 

Event[50]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T16:13:42.5620000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[51]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T16:13:42.5870000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 1 to 3.

Reason AcDcBurst 

BootId: 9 

Event[52]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T16:13:48.3570000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 3 to 4.

Reason AcDcBurst 

BootId: 9 

Event[53]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T16:23:10.0480000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 4 to 6.

Reason SxTransition 

BootId: 9 

Event[54]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T16:23:15.6730000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[55]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T16:23:17.5380000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[56]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T16:23:21.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?09?-?16T12:23:21.500000000Z from ?2025?-?09?-?16T12:23:17.538178800Z.
Time Delta: 3961 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?09?-?16T17:53:21.500000000Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[57]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T16:23:21.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 1, FullResume: 718, AverageResume: 718 

Event[58]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T16:23:21.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 32836749, SuspendEnd: 32836750 

Event[59]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T16:23:21.6720000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 6 to 7.

Reason SxTransition 

BootId: 9 

Event[60]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-09-16T16:23:22.0630000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?09?-?16T12:23:10.036962000Z
Wake Time: ?2025?-?09?-?16T12:23:21.670051400Z

Wake Source: Power Button 

Event[61]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T16:23:22.3870000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 7 to 9.

Reason Unknown 

BootId: 9 

Event[62]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-16T16:35:12.4550000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[63]
  Log Name: System
  Source: Tcpip
  Date: 2025-09-16T18:27:22.3430000Z
  Event ID: 4227
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
TCP/IP failed to establish an outgoing connection because the selected local endpoint was recently used to connect to the same remote endpoint. This error typically occurs when outgoing connections are opened and closed at a high rate, causing all available local ports to be used and forcing TCP/IP to reuse a local port for an outgoing connection. To minimize the risk of data corruption, the TCP/IP standard requires a minimum time period to elapse between successive connections from a given local endpoint to a given remote endpoint. 

Event[64]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T18:34:27.1090000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[65]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:34:51.7690000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (Version 6.1, ?2019?-?02?-?11T22:09:19.000000000Z) unloaded successfully. 

Event[66]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T18:34:52.0460000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the DbxSvc service was changed from auto start to disabled. 

Event[67]
  Log Name: System
  Source: Tcpip
  Date: 2025-09-16T18:37:09.5790000Z
  Event ID: 4227
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
TCP/IP failed to establish an outgoing connection because the selected local endpoint was recently used to connect to the same remote endpoint. This error typically occurs when outgoing connections are opened and closed at a high rate, causing all available local ports to be used and forcing TCP/IP to reuse a local port for an outgoing connection. To minimize the risk of data corruption, the TCP/IP standard requires a minimum time period to elapse between successive connections from a given local endpoint to a given remote endpoint. 

Event[68]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-16T18:43:26.3310000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[69]
  Log Name: System
  Source: User32
  Date: 2025-09-16T18:43:33.2140000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe (256GB-SSD) has initiated the restart of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: restart
 Comment:  

Event[70]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-16T18:43:38.9190000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[71]
  Log Name: System
  Source: EventLog
  Date: 2025-09-16T18:45:05.9300000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[72]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T18:45:05.8500000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[73]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-16T18:45:05.9160000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[74]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-16T18:45:05.9160000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[75]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-16T18:45:05.9280000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[76]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-16T18:45:05.9290000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[77]
  Log Name: System
  Source: EventLog
  Date: 2025-09-16T18:45:21.7190000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[78]
  Log Name: System
  Source: EventLog
  Date: 2025-09-16T18:45:21.7200000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[79]
  Log Name: System
  Source: EventLog
  Date: 2025-09-16T18:45:21.7200000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[80]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-16T18:45:05.9550000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[81]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-16T18:45:06.1500000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[82]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-16T18:45:06.1800000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[83]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T18:45:06.7250000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Reboot 
Event Code: 0x0 
Reason: Kernel API 

Event[84]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T18:45:06.8630000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[85]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T18:45:06.8630000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[86]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T18:45:09.1530000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[87]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T18:45:09.4170000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?09?-?16T14:45:09.417398800Z. 

Event[88]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T18:45:16.9190000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?09?-?16T14:45:16.500000000Z. 

Event[89]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T18:45:16.9190000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?09?-?16T14:45:16.500000000Z. 

Loader time: ?2025?-?09?-?16T14:45:15.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[90]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-16T18:45:16.9200000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[91]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-16T18:45:16.9200000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[92]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-16T18:45:16.9200000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[93]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-16T18:45:16.9200000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[94]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-16T18:45:16.9200000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[95]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-16T18:45:16.9200000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?09?-?16T20:15:15.000000000Z. 

Event[96]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-16T18:45:16.9200000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[97]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-16T18:45:16.9200000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[98]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-16T18:45:16.9250000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[99]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T18:45:16.9260000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[100]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-09-16T18:45:16.9830000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[101]
  Log Name: System
  Source: Application Popup
  Date: 2025-09-16T18:45:17.1470000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[102]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:45:17.3700000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[103]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:45:17.3710000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[104]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:45:17.3730000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2020?-?11?-?18T22:54:15.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[105]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-16T18:45:17.7790000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[106]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:45:17.8710000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[107]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:45:17.8760000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[108]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:45:17.9820000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[109]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T18:45:18.0140000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[110]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T18:45:18.0140000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[111]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T18:45:18.0160000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[112]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-16T18:45:18.5080000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[113]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-16T18:45:18.5480000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[114]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-16T18:45:18.5600000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[115]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-16T18:45:18.5710000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[116]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-16T18:45:18.5730000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[117]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-16T18:45:18.5750000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[118]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-16T18:45:18.5760000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[119]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-16T18:45:18.5770000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[120]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-16T18:45:18.5780000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[121]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-16T18:45:18.5800000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[122]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-16T18:45:18.5810000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[123]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T18:45:18.5850000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[124]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T18:45:18.6530000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[125]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-16T18:45:19.1190000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[126]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-16T18:45:19.3240000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[127]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T18:45:19.3910000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[128]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-16T18:45:20.1360000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[129]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-16T18:45:20.1360000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: false
Start time: ?1601?-?01?-?01T00:00:00.000000000Z
Grace period: 0
Attempted recovery enforcement succeeded: false
 

Event[130]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-16T18:45:20.1370000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[131]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-16T18:45:20.2560000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[132]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-16T18:45:20.2580000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[133]
  Log Name: System
  Source: LsaSrv
  Date: 2025-09-16T18:45:20.3120000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[134]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-16T18:45:20.4930000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[135]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-16T18:45:20.5030000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[136]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-16T18:45:20.5030000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[137]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:45:21.4980000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[138]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:45:21.5100000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[139]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:45:21.5230000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[140]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:45:21.5430000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[141]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:45:21.5660000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[142]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:45:21.5660000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[143]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:45:21.5660000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[144]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:45:21.5690000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[145]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:45:21.5850000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[146]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:45:21.5910000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[147]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-16T18:45:21.8880000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[148]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-16T18:45:21.8880000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[149]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-16T18:45:21.8880000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[150]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-16T18:45:21.9100000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[151]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:45:22.1040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[152]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:45:22.1040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[153]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:45:22.1040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[154]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:45:22.1040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[155]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:45:22.1040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[156]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:45:22.1040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[157]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:45:22.1040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[158]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:45:22.1040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[159]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:45:22.1040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[160]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:45:22.1040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[161]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:45:22.1040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[162]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:45:22.1040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[163]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:45:22.1040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[164]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:45:22.1040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[165]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T18:45:22.5740000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[166]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T18:45:24.7130000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[167]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-16T18:45:24.8260000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[168]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-16T18:45:24.8260000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000010-0000000000.json for detailed information on what checks were made. 

Event[169]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-16T18:45:24.8750000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[170]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-16T18:45:24.9150000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[171]
  Log Name: System
  Source: TPM
  Date: 2025-09-16T18:45:27.2770000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[172]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-16T18:45:27.9100000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[173]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-16T18:45:28.6080000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[174]
  Log Name: System
  Source: Microsoft-Windows-HttpEvent
  Date: 2025-09-16T18:45:31.9670000Z
  Event ID: 15008
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Reservation for namespace identified by URL prefix http://+:10246/MDEServer/ was successfully deleted. 

Event[175]
  Log Name: System
  Source: Microsoft-Windows-HttpEvent
  Date: 2025-09-16T18:45:31.9830000Z
  Event ID: 15008
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Reservation for namespace identified by URL prefix https://+:10245/WMPNSSv4/ was successfully deleted. 

Event[176]
  Log Name: System
  Source: Microsoft-Windows-HttpEvent
  Date: 2025-09-16T18:45:31.9830000Z
  Event ID: 15008
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Reservation for namespace identified by URL prefix http://+:10243/WMPNSSv4/ was successfully deleted. 

Event[177]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T18:45:32.1320000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[178]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T18:45:32.1320000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?09?-?16T14:45:32.126348800Z from ?2025?-?09?-?16T14:45:32.126348800Z.
Time Delta: 0 ms

Change Reason: System time adjusted to the new time zone.
Process: '\Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe' (PID 2332).

RTC time: ?2025?-?09?-?16T20:15:32.126348800Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[179]
  Log Name: System
  Source: Microsoft-Windows-HttpEvent
  Date: 2025-09-16T18:45:32.1420000Z
  Event ID: 15008
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Reservation for namespace identified by URL prefix https://+:3392/rdp/ was successfully deleted. 

Event[180]
  Log Name: System
  Source: Microsoft-Windows-HttpEvent
  Date: 2025-09-16T18:45:32.1420000Z
  Event ID: 15008
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Reservation for namespace identified by URL prefix http://+:3387/rdp/ was successfully deleted. 

Event[181]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T18:45:44.1010000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.UI.Xaml.CBS_9.2504.3002.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[182]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T18:45:44.8740000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.ShellExperienceHost_10.0.26100.5074_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[183]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T18:45:45.6980000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.StartMenuExperienceHost_10.0.26100.4768_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[184]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T18:45:46.9200000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAppRuntime.CBS.1.6_6000.561.2259.100_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[185]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T18:45:47.4940000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.54792954.Filons_1000.26100.6584.0_x64__cw5n1h2txyewy\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[186]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T18:45:48.6020000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.CBS_1000.26100.234.0_x64__cw5n1h2txyewy\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[187]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T18:45:50.5000000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.CoreAI_1000.26100.6584.0_x64__cw5n1h2txyewy\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[188]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T18:45:51.3730000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.Core_1000.26100.78.0_x64__cw5n1h2txyewy\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[189]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T18:45:52.4210000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.FileExp_1000.26100.4.0_x64__cw5n1h2txyewy\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[190]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T18:45:52.9930000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.OOBE_1000.26100.15.0_x64__cw5n1h2txyewy\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[191]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T18:45:53.5950000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.Photon_1000.26100.10.0_x64__cw5n1h2txyewy\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[192]
  Log Name: System
  Source: Virtual Disk Service
  Date: 2025-09-16T18:46:00.1920000Z
  Event ID: 3
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Service started. 

Event[193]
  Log Name: System
  Source: Microsoft-Windows-Eventlog
  Date: 2025-09-16T18:45:59.6750000Z
  Event ID: 30
  Task: Service startup 
  Level: Error 
  Opcode: Info  
  Keyword: Service availability, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The event logging service encountered an error (5) while enabling publisher {8e889f0c-7d54-52b3-e4ae-2c8b27a482c2} to channel Microsoft-Windows-LocationServiceProvider/Operational. This does not affect channel operation, but does affect the ability of the publisher to raise events to the channel. One common reason for this error is that the Provider is using ETW Provider Security and has not granted enable permissions to the Event Log service identity. 

Event[194]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:45:59.8840000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x91C Executable path \Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe, User S-1-5-18 

Event[195]
  Log Name: System
  Source: Microsoft-Windows-HttpEvent
  Date: 2025-09-16T18:45:59.8770000Z
  Event ID: 15007
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Reservation for namespace identified by URL prefix https://+:3392/rdp/ was successfully added. 

Event[196]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:45:59.8840000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x91C Executable path \Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe, User S-1-5-18 

Event[197]
  Log Name: System
  Source: Microsoft-Windows-HttpEvent
  Date: 2025-09-16T18:45:59.8770000Z
  Event ID: 15007
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Reservation for namespace identified by URL prefix http://+:3387/rdp/ was successfully added. 

Event[198]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:46:00.0140000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x91C Executable path \Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe, User S-1-5-18 

Event[199]
  Log Name: System
  Source: Microsoft-Windows-HttpEvent
  Date: 2025-09-16T18:46:00.0040000Z
  Event ID: 15007
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Reservation for namespace identified by URL prefix https://+:10245/WMPNSSv4/ was successfully added. 

Event[200]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:46:00.0150000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x91C Executable path \Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe, User S-1-5-18 

Event[201]
  Log Name: System
  Source: Microsoft-Windows-HttpEvent
  Date: 2025-09-16T18:46:00.0040000Z
  Event ID: 15007
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Reservation for namespace identified by URL prefix http://+:10243/WMPNSSv4/ was successfully added. 

Event[202]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:46:00.0180000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x91C Executable path \Device\HarddiskVolume3\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.5074_none_a5532eb7772ad4c4\TiWorker.exe, User S-1-5-18 

Event[203]
  Log Name: System
  Source: Microsoft-Windows-HttpEvent
  Date: 2025-09-16T18:46:00.0040000Z
  Event ID: 15007
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Reservation for namespace identified by URL prefix http://+:10246/MDEServer/ was successfully added. 

Event[204]
  Log Name: System
  Source: Microsoft-Windows-WinREAgent
  Date: 2025-09-16T18:46:15.0690000Z
  Event ID: 4501
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Servicing succeeded. The Windows Recovery Environment version is now: 10.0.26100.5059 

Event[205]
  Log Name: System
  Source: Virtual Disk Service
  Date: 2025-09-16T18:46:24.9040000Z
  Event ID: 4
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Service stopped. 

Event[206]
  Log Name: System
  Source: EventLog
  Date: 2025-09-16T18:46:25.3740000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[207]
  Log Name: System
  Source: User32
  Date: 2025-09-16T18:46:24.8260000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The process C:\WINDOWS\servicing\TrustedInstaller.exe (256GB-SSD) has initiated the restart of computer 256GB-SSD on behalf of user NT AUTHORITY\SYSTEM for the following reason: Operating System: Upgrade (Planned)
 Reason Code: 0x80020003
 Shutdown Type: restart
 Comment:  

Event[208]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T18:46:25.3090000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[209]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-16T18:46:25.3550000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[210]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-16T18:46:25.3570000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[211]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-16T18:46:25.3590000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[212]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-16T18:46:25.3660000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[213]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-16T18:46:25.3660000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[214]
  Log Name: System
  Source: EventLog
  Date: 2025-09-16T18:46:37.7230000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[215]
  Log Name: System
  Source: EventLog
  Date: 2025-09-16T18:46:37.7230000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[216]
  Log Name: System
  Source: EventLog
  Date: 2025-09-16T18:46:37.7260000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 4 seconds. 

Event[217]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-16T18:46:25.5560000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[218]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-16T18:46:25.5740000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[219]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T18:46:25.6840000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Reboot 
Event Code: 0x0 
Reason: Kernel API 

Event[220]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T18:46:26.2670000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[221]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T18:46:26.3110000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[222]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T18:46:26.3110000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[223]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T18:46:26.5550000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?09?-?16T14:46:26.555153300Z. 

Event[224]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T18:46:33.8940000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?09?-?16T14:46:33.500000000Z. 

Event[225]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T18:46:33.8940000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?09?-?16T14:46:33.500000000Z. 

Loader time: ?2025?-?09?-?16T14:46:33.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[226]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-16T18:46:33.8950000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[227]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-16T18:46:33.8950000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[228]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-16T18:46:33.8950000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[229]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-16T18:46:33.8950000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[230]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-16T18:46:33.8950000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[231]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-16T18:46:33.8950000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?09?-?16T20:16:33.000000000Z. 

Event[232]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-16T18:46:33.8950000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[233]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-16T18:46:33.8950000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[234]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-16T18:46:33.8990000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[235]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T18:46:33.8990000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[236]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-09-16T18:46:33.9450000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[237]
  Log Name: System
  Source: Application Popup
  Date: 2025-09-16T18:46:34.1080000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[238]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:46:34.3180000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[239]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:46:34.3190000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[240]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:46:34.3200000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2020?-?11?-?18T22:54:15.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[241]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-16T18:46:34.6450000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[242]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:46:34.7260000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[243]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:46:34.7310000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[244]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:46:34.8370000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[245]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T18:46:34.8690000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[246]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T18:46:34.8690000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[247]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T18:46:34.8710000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[248]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-16T18:46:35.3610000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[249]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-16T18:46:35.4040000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[250]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-16T18:46:35.4130000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[251]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-16T18:46:35.4280000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[252]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-16T18:46:35.4280000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[253]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-16T18:46:35.4300000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[254]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-16T18:46:35.4310000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[255]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-16T18:46:35.4330000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[256]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-16T18:46:35.4340000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[257]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-16T18:46:35.4350000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[258]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-16T18:46:35.4970000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[259]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T18:46:35.5020000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[260]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-16T18:46:35.5400000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[261]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T18:46:35.5560000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[262]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-16T18:46:36.0770000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[263]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T18:46:36.1530000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[264]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-16T18:46:36.8020000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[265]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-16T18:46:36.8020000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: false
Start time: ?1601?-?01?-?01T00:00:00.000000000Z
Grace period: 0
Attempted recovery enforcement succeeded: false
 

Event[266]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-16T18:46:36.8030000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: STATUS_SUCCESS
New timer needed: true
New timer waiting for system update completion: true
Previous latch timer exists but disabled by registry: false
 

Event[267]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-16T18:46:36.9020000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[268]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-16T18:46:36.9040000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[269]
  Log Name: System
  Source: LsaSrv
  Date: 2025-09-16T18:46:36.9560000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[270]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-16T18:46:37.1290000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[271]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-16T18:46:37.1400000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[272]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-16T18:46:37.1400000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[273]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:46:37.5740000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[274]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:46:37.5840000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[275]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:46:37.5890000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[276]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:46:37.5990000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[277]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:46:37.6160000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[278]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:46:37.6160000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[279]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:46:37.6160000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[280]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:46:37.6220000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[281]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:46:37.6320000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[282]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-16T18:46:37.6390000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[283]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-16T18:46:37.9540000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[284]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-16T18:46:37.9540000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[285]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-16T18:46:37.9540000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[286]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-16T18:46:37.9760000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[287]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:46:38.1360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[288]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:46:38.1360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[289]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:46:38.1360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[290]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:46:38.1360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[291]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:46:38.1360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[292]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:46:38.1360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[293]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:46:38.1360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[294]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:46:38.1360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[295]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:46:38.1360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[296]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:46:38.1360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[297]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:46:38.1360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[298]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:46:38.1360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[299]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:46:38.1360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[300]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-16T18:46:38.1360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[301]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T18:46:38.6060000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[302]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-16T18:46:39.8750000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[303]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-16T18:46:39.8750000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000011-0000000000.json for detailed information on what checks were made. 

Event[304]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T18:46:40.2990000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[305]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-16T18:46:40.4600000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[306]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-16T18:46:40.5040000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[307]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-16T18:46:42.7460000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[308]
  Log Name: System
  Source: TPM
  Date: 2025-09-16T18:46:44.2370000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[309]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T18:46:45.4260000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from auto start to demand start. 

Event[310]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-16T18:46:45.7150000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[311]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-16T18:46:46.1850000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[312]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-16T18:47:46.5600000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[313]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-16T18:47:46.5760000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[314]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-16T18:47:46.5920000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[315]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-16T18:47:46.5920000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[316]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-16T18:47:46.5920000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[317]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-16T18:47:46.5920000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[318]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-16T18:47:46.5920000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[319]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-16T18:47:46.6080000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[320]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-16T18:48:52.4050000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: 2025-09 Cumulative Update for Windows 11 Version 24H2 for x64-based Systems (KB5065426) (26100.6584) 

Event[321]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-16T18:51:38.6050000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[322]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-16T18:51:38.6050000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[323]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T18:56:40.9300000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[324]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T19:00:12.5350000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[325]
  Log Name: System
  Source: EventLog
  Date: 2025-09-16T19:35:42.8730000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[326]
  Log Name: System
  Source: User32
  Date: 2025-09-16T19:35:42.2740000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The process C:\WINDOWS\system32\winlogon.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
 Reason Code: 0x500ff
 Shutdown Type: power off
 Comment:  

Event[327]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T19:35:42.8150000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[328]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-16T19:35:42.8680000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[329]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-16T19:35:42.8680000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[330]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-16T19:35:42.8720000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[331]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-16T19:35:42.8740000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[332]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-16T19:35:42.8740000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[333]
  Log Name: System
  Source: EventLog
  Date: 2025-09-17T07:12:56.5590000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[334]
  Log Name: System
  Source: EventLog
  Date: 2025-09-17T07:12:56.5590000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[335]
  Log Name: System
  Source: EventLog
  Date: 2025-09-17T07:12:56.5600000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[336]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-16T19:35:43.0440000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[337]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-16T19:35:43.0680000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[338]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T19:35:43.5010000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[339]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T19:35:43.8300000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[340]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-16T19:35:43.8300000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[341]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-16T19:35:46.0700000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[342]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-16T19:35:46.2360000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?09?-?16T15:35:46.236309000Z. 

Event[343]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-17T07:12:51.9060000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?09?-?17T03:12:51.500000000Z. 

Event[344]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-17T07:12:51.9060000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?09?-?17T03:12:51.500000000Z. 

Loader time: ?2025?-?09?-?17T03:12:51.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[345]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-17T07:12:51.9070000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[346]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-17T07:12:51.9070000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[347]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-17T07:12:51.9070000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[348]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-17T07:12:51.9070000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[349]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-17T07:12:51.9070000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[350]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-17T07:12:51.9070000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?09?-?17T08:42:51.000000000Z. 

Event[351]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-17T07:12:51.9070000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[352]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-17T07:12:51.9070000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[353]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-17T07:12:51.9110000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[354]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-17T07:12:51.9110000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[355]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-09-17T07:12:51.9690000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[356]
  Log Name: System
  Source: Application Popup
  Date: 2025-09-17T07:12:52.1180000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[357]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:12:52.3320000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[358]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:12:52.3330000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[359]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:12:52.3340000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2020?-?11?-?18T22:54:15.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[360]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-17T07:12:52.6840000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[361]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:12:52.7610000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[362]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:12:52.7670000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[363]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:12:52.8750000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[364]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-17T07:12:52.9090000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[365]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-17T07:12:52.9090000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[366]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-17T07:12:52.9110000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[367]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-17T07:12:53.4020000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[368]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-17T07:12:53.4650000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[369]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-17T07:12:53.4650000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[370]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:12:53.4820000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[371]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:12:53.4900000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[372]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:12:53.4910000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[373]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:12:53.4920000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[374]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:12:53.4930000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[375]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:12:53.4960000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[376]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:12:53.4970000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[377]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-17T07:12:53.5820000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[378]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:12:53.6710000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[379]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-17T07:12:53.6920000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[380]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-17T07:12:53.7650000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[381]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-17T07:12:54.0850000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[382]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-17T07:12:54.1580000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[383]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-17T07:12:55.0890000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[384]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-17T07:12:55.0890000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[385]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-17T07:12:55.0890000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[386]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-17T07:12:55.0910000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[387]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-17T07:12:55.1880000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[388]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-17T07:12:55.1900000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[389]
  Log Name: System
  Source: LsaSrv
  Date: 2025-09-17T07:12:55.2420000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[390]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-17T07:12:55.4230000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[391]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-17T07:12:55.4350000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[392]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-17T07:12:55.4350000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[393]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:12:56.3880000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[394]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:12:56.4010000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[395]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:12:56.4130000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[396]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:12:56.4280000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[397]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:12:56.4430000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[398]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:12:56.4580000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[399]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:12:56.4580000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[400]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:12:56.4590000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[401]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:12:56.4660000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[402]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:12:56.4740000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[403]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-17T07:12:56.7610000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[404]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-17T07:12:56.7610000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[405]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-17T07:12:56.7610000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[406]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-17T07:12:56.8160000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[407]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:12:56.9980000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[408]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:12:56.9980000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[409]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:12:56.9980000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[410]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:12:56.9980000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[411]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:12:56.9980000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[412]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:12:56.9980000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[413]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:12:56.9980000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[414]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:12:56.9980000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[415]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:12:56.9980000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[416]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:12:56.9980000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[417]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:12:56.9980000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[418]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:12:56.9980000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[419]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:12:56.9980000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[420]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:12:56.9980000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[421]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-17T07:12:57.4030000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[422]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-17T07:12:58.8270000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[423]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-17T07:12:58.8270000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000012-0000000000.json for detailed information on what checks were made. 

Event[424]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-17T07:12:59.1480000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[425]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-17T07:12:59.2870000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[426]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-17T07:12:59.3330000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[427]
  Log Name: System
  Source: TPM
  Date: 2025-09-17T07:13:02.2360000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[428]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-17T07:13:03.0020000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[429]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-17T07:13:03.4440000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[430]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:14:04.6390000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[431]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:14:04.6540000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[432]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:14:04.6540000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[433]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:14:04.6540000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[434]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:14:04.6540000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[435]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:14:04.6540000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[436]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:14:04.6540000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[437]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:14:04.6550000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[438]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-17T07:15:39.9810000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[439]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-17T07:15:46.2500000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\MicrosoftWindows.Client.CoreAI_cw5n1h2txyewy\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages. 

Event[440]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-17T07:17:57.0150000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[441]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-17T07:17:57.0150000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[442]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-17T07:17:58.3230000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[443]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-17T07:18:40.9070000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[444]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-17T07:19:41.3480000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[445]
  Log Name: System
  Source: User32
  Date: 2025-09-17T07:20:27.3750000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\WINDOWS\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe (256GB-SSD) has initiated the restart of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: restart
 Comment:  

Event[446]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-17T07:20:30.0930000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[447]
  Log Name: System
  Source: EventLog
  Date: 2025-09-17T07:20:31.8040000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[448]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-17T07:20:31.2730000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[449]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-17T07:20:31.7500000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[450]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-17T07:20:31.7990000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[451]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-17T07:20:31.7990000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[452]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-17T07:20:31.8000000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[453]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-17T07:20:31.8000000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[454]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-17T07:20:31.8040000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[455]
  Log Name: System
  Source: EventLog
  Date: 2025-09-17T07:20:46.5390000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[456]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-17T07:20:31.9760000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[457]
  Log Name: System
  Source: EventLog
  Date: 2025-09-17T07:20:46.5430000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[458]
  Log Name: System
  Source: EventLog
  Date: 2025-09-17T07:20:46.5440000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[459]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-17T07:20:32.0000000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[460]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-17T07:20:32.3550000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Reboot 
Event Code: 0x0 
Reason: Kernel API 

Event[461]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-17T07:20:32.7650000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[462]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-17T07:20:32.7650000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[463]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-17T07:20:34.6370000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[464]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-17T07:20:34.9080000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?09?-?17T03:20:34.908301400Z. 

Event[465]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-17T07:20:41.9060000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?09?-?17T03:20:41.500000000Z. 

Event[466]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-17T07:20:41.9060000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?09?-?17T03:20:41.500000000Z. 

Loader time: ?2025?-?09?-?17T03:20:40.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[467]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-17T07:20:41.9070000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[468]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-17T07:20:41.9070000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[469]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-17T07:20:41.9070000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[470]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-17T07:20:41.9070000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[471]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-17T07:20:41.9070000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[472]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-17T07:20:41.9070000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?09?-?17T08:50:40.000000000Z. 

Event[473]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-17T07:20:41.9070000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[474]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-17T07:20:41.9070000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[475]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-17T07:20:41.9110000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[476]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-17T07:20:41.9110000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[477]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-09-17T07:20:41.9480000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[478]
  Log Name: System
  Source: Application Popup
  Date: 2025-09-17T07:20:42.1120000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[479]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:20:42.3200000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[480]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:20:42.3210000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[481]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:20:42.3220000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2020?-?11?-?18T22:54:15.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[482]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-17T07:20:42.6520000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[483]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:20:42.7290000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[484]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:20:42.7340000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[485]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:20:42.8400000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[486]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-17T07:20:42.8730000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[487]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-17T07:20:42.8730000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[488]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-17T07:20:42.8750000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[489]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-17T07:20:43.3780000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[490]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:20:43.4200000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[491]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:20:43.4310000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[492]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-17T07:20:43.4410000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[493]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-17T07:20:43.4410000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[494]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:20:43.4450000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[495]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:20:43.4470000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[496]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:20:43.4540000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[497]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:20:43.4550000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[498]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:20:43.4560000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[499]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:20:43.5170000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[500]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-17T07:20:43.5330000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[501]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-17T07:20:43.5820000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[502]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-17T07:20:43.6340000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[503]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-17T07:20:43.9420000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[504]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-17T07:20:44.0030000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[505]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-17T07:20:45.0760000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[506]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-17T07:20:45.0760000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[507]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-17T07:20:45.0760000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[508]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-17T07:20:45.0770000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[509]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-17T07:20:45.1680000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[510]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-17T07:20:45.1700000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[511]
  Log Name: System
  Source: LsaSrv
  Date: 2025-09-17T07:20:45.2220000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[512]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-17T07:20:45.4340000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[513]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-17T07:20:45.4460000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[514]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-17T07:20:45.4460000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[515]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:20:46.3840000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[516]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:20:46.3940000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[517]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:20:46.4000000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[518]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:20:46.4100000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[519]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:20:46.4280000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[520]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:20:46.4280000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[521]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:20:46.4280000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[522]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:20:46.4330000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[523]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:20:46.4400000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[524]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T07:20:46.4480000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[525]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-17T07:20:46.7610000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[526]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-17T07:20:46.7610000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[527]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-17T07:20:46.7610000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[528]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-17T07:20:46.7970000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[529]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-17T07:20:46.9910000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[530]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:20:47.0030000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[531]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:20:47.0030000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[532]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:20:47.0030000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[533]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:20:47.0030000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[534]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:20:47.0030000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[535]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:20:47.0030000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[536]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:20:47.0030000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[537]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:20:47.0030000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[538]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:20:47.0030000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[539]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:20:47.0030000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[540]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:20:47.0030000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[541]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:20:47.0030000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[542]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:20:47.0030000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[543]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-17T07:20:47.0030000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[544]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-17T07:20:47.3200000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[545]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-17T07:20:48.7160000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[546]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-17T07:20:48.7160000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000013-0000000000.json for detailed information on what checks were made. 

Event[547]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-17T07:20:49.1230000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[548]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-17T07:20:49.2490000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[549]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-17T07:20:49.2880000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[550]
  Log Name: System
  Source: TPM
  Date: 2025-09-17T07:20:52.2440000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[551]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-17T07:20:53.6160000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[552]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-17T07:20:55.8910000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[553]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:21:54.5900000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[554]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:21:54.5900000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[555]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:21:54.6060000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[556]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:21:54.6060000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[557]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:21:54.6220000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[558]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:21:54.6220000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[559]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:21:54.6220000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[560]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-17T07:21:54.6220000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[561]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-17T07:21:55.7110000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[562]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-17T07:22:50.9680000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[563]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-17T07:22:50.9690000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[564]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-17T07:23:24.6020000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[565]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-17T07:25:47.0180000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[566]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-17T07:25:47.0180000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[567]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-17T07:27:29.5790000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[568]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-17T07:27:29.5820000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[569]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-17T07:27:29.5840000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[570]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-17T07:27:29.5850000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[571]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-17T07:32:16.9460000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[572]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-17T07:32:22.2990000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.435.784.0) - Current Channel (Broad) 

Event[573]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-17T07:32:33.5230000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.435.784.0) - Current Channel (Broad) 

Event[574]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-17T07:33:25.8100000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[575]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-17T07:36:41.4580000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[576]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-17T07:38:54.0300000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAppRuntime.1.7_7000.617.2103.0_x86__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[577]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-17T07:40:47.1280000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[578]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-17T07:42:30.1470000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[579]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-17T07:48:18.6790000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[580]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-17T10:21:47.2510000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[581]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-17T10:23:05.5370000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[582]
  Log Name: System
  Source: EventLog
  Date: 2025-09-17T10:30:00.5440000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 11359 seconds. 

Event[583]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-17T10:37:39.8580000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[584]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-17T10:42:00.7950000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[585]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-17T10:49:14.8500000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[586]
  Log Name: System
  Source: Microsoft-Windows-UserModePowerService
  Date: 2025-09-17T10:49:18.4140000Z
  Event ID: 22
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Reapply power settings upon completion of the provisioning engine's turn 5 

Event[587]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-17T10:56:22.4560000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[588]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-17T10:56:25.1350000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[589]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-17T10:56:27.1870000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[590]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-17T10:56:40.6180000Z
  Event ID: 35
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time service is now synchronizing the system time with the time source time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123) with reference id 3611644667. Current local stratum number is 4. 

Event[591]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-17T10:56:40.6190000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[592]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-17T10:56:40.6190000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?09?-?17T06:56:40.619589700Z from ?2025?-?09?-?17T06:56:40.619546400Z.
Time Delta: 0 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 5760).

RTC time: ?2025?-?09?-?17T12:26:40.619589700Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[593]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-17T11:19:55.4010000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[594]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-17T11:22:59.9130000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[595]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-17T11:23:07.6430000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[596]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-09-17T11:24:58.0610000Z
  Event ID: 10121
  Task: User-mode Driver problems. 
  Level: Critical 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
A runtime failure has occurred in user-mode driver AppleUsbFilter.dll and the hosting process has been terminated. This may temporarily interrupt your ability to access the devices. Please contact the device manufacturer or driver vendor for more information about this problem. 

Event[597]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-09-17T11:24:58.0620000Z
  Event ID: 10120
  Task: User-mode Driver problems. 
  Level: Critical 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A problem has occurred with one or more user-mode drivers and the hosting process has been terminated.  This may temporarily interrupt your ability to access the devices. 

Event[598]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-09-17T11:24:58.1120000Z
  Event ID: 10116
  Task: User-mode Driver problems. 
  Level: Critical 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The device Apple iPhone (location 0000.0014.0000.003.000.000.000.000.000) is offline due to a user-mode driver crash.  Windows will attempt to restart the device in the shared process 1 more times before moving the device in its own process.  Please contact the device manufacturer for more information about this problem. 

Event[599]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-09-17T11:24:58.1130000Z
  Event ID: 10116
  Task: User-mode Driver problems. 
  Level: Critical 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The device Apple Mobile Device USB Device (location 0000.0014.0000.003.000.000.000.000.000) is offline due to a user-mode driver crash.  Windows will attempt to restart the device in the shared process 1 more times before moving the device in its own process.  Please contact the device manufacturer for more information about this problem. 

Event[600]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-17T11:25:28.6500000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[601]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-17T11:41:55.3290000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[602]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-17T11:47:45.5660000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[603]
  Log Name: System
  Source: Tcpip
  Date: 2025-09-17T12:53:43.2100000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[604]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-17T13:41:58.5810000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[605]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-17T13:43:44.6910000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[606]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-17T13:55:00.4220000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[607]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-17T14:04:28.5610000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[608]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-17T14:27:04.8210000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[609]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-17T14:27:12.6390000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[610]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-17T14:34:42.3810000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[611]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-17T14:36:12.2620000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[612]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-17T14:38:31.5850000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name search.brave.com timed out after none of the configured DNS servers responded. Client PID 3872. 

Event[613]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-17T15:26:28.7740000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume ?? (\Device\HarddiskVolumeShadowCopy1) is healthy.  No action is needed. 

Event[614]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-17T15:26:35.9760000Z
  Event ID: 11
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\WINDOWS\System32\config\SYSTEM (TM: {4a486cbe-9375-11f0-a0af-507b9da345ea}, RM: {4a486cbd-9375-11f0-a0af-507b9da345ea}) finished with result=0xC00000A2 (Internal code=7). 

Event[615]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-17T15:26:36.1980000Z
  Event ID: 11
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\WINDOWS\System32\config\DRIVERS (TM: {4a486cc1-9375-11f0-a0af-507b9da345ea}, RM: {4a486cc0-9375-11f0-a0af-507b9da345ea}) finished with result=0xC00000A2 (Internal code=7). 

Event[616]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-17T15:26:36.9050000Z
  Event ID: 11
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\WINDOWS\System32\config\SOFTWARE (TM: {4a486cc4-9375-11f0-a0af-507b9da345ea}, RM: {4a486cc3-9375-11f0-a0af-507b9da345ea}) finished with result=0xC00000A2 (Internal code=7). 

Event[617]
  Log Name: System
  Source: Tcpip
  Date: 2025-09-17T16:39:06.7150000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[618]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-17T16:41:54.4870000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[619]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-17T16:42:12.5160000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[620]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-17T16:42:42.6740000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[621]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-17T16:44:55.1800000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[622]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-17T16:48:55.7050000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[623]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-17T16:49:05.8840000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[624]
  Log Name: System
  Source: Microsoft-Windows-Configuration-Change-Monitor
  Date: 2025-09-17T16:52:06.1110000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
N/A

Event[625]
  Log Name: System
  Source: Microsoft-Windows-Configuration-Change-Monitor
  Date: 2025-09-17T16:52:06.2170000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
N/A

Event[626]
  Log Name: System
  Source: Microsoft-Windows-Configuration-Change-Monitor
  Date: 2025-09-17T16:52:06.2980000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
N/A

Event[627]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-17T16:52:07.6400000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  Dropbox Elevation Service (DropboxElevationService)
Service File Name:  "C:\Program Files (x86)\Dropbox\Client\232.4.5988\DropboxElevationService.exe" --svc --appid={cc46080e-4c33-4981-859a-bba2f780f31e}
Service Type:  user mode service
Service Start Type:  demand start
Service Account:  LocalSystem 

Event[628]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-17T16:52:08.5620000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  DbxSvc
Service File Name:  %SystemRoot%\System32\DbxSvc.exe
Service Type:  user mode service
Service Start Type:  auto start
Service Account:  LocalSystem 

Event[629]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-17T16:52:48.5370000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[630]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-17T16:54:42.5980000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[631]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-17T18:00:33.3550000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[632]
  Log Name: System
  Source: Tcpip
  Date: 2025-09-17T18:01:34.7130000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[633]
  Log Name: System
  Source: User32
  Date: 2025-09-17T18:55:13.1790000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\WINDOWS\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[634]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-17T18:55:13.9990000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[635]
  Log Name: System
  Source: EventLog
  Date: 2025-09-17T18:55:14.6420000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[636]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-17T18:55:14.2440000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[637]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-17T18:55:14.5970000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Portable Device Enumerator Service service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion. 

Event[638]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-17T18:55:14.6290000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[639]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-17T18:55:14.6290000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[640]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-17T18:55:14.6300000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[641]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-17T18:55:14.6320000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[642]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-17T18:55:14.6330000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[643]
  Log Name: System
  Source: EventLog
  Date: 2025-09-18T07:18:34.7210000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[644]
  Log Name: System
  Source: EventLog
  Date: 2025-09-18T07:18:34.7220000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[645]
  Log Name: System
  Source: EventLog
  Date: 2025-09-18T07:18:34.7230000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[646]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-17T18:55:14.8310000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[647]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-17T18:55:14.8560000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[648]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-17T18:55:17.2780000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[649]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-17T18:55:19.8010000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[650]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-17T18:55:20.2620000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?09?-?17T14:55:20.262518000Z. 

Event[651]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-18T07:18:29.9120000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?09?-?18T03:18:29.500000000Z. 

Event[652]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-18T07:18:29.9120000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?09?-?18T03:18:29.500000000Z. 

Loader time: ?2025?-?09?-?18T03:18:28.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[653]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-18T07:18:29.9130000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[654]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-18T07:18:29.9130000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[655]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-18T07:18:29.9130000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[656]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-18T07:18:29.9130000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[657]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-18T07:18:29.9130000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[658]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-18T07:18:29.9130000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?09?-?18T08:48:28.000000000Z. 

Event[659]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-18T07:18:29.9130000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[660]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-18T07:18:29.9130000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[661]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-18T07:18:29.9170000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[662]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-18T07:18:29.9170000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[663]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-09-18T07:18:29.9540000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[664]
  Log Name: System
  Source: Application Popup
  Date: 2025-09-18T07:18:30.1050000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[665]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T07:18:30.3180000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[666]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T07:18:30.3190000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[667]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T07:18:30.3200000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2020?-?11?-?18T22:54:15.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[668]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-18T07:18:30.7340000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[669]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T07:18:30.8420000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[670]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T07:18:30.8480000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[671]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T07:18:30.9580000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[672]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T07:18:30.9910000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[673]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T07:18:30.9910000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[674]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T07:18:30.9940000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[675]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-18T07:18:31.4840000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[676]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T07:18:31.5260000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[677]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T07:18:31.5350000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[678]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T07:18:31.5440000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[679]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T07:18:31.5450000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[680]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T07:18:31.5490000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[681]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T07:18:31.5500000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[682]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T07:18:31.5510000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[683]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-18T07:18:31.5510000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[684]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-18T07:18:31.5510000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[685]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T07:18:31.6230000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[686]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-18T07:18:31.6730000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[687]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T07:18:31.6880000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[688]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T07:18:31.7500000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[689]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-18T07:18:32.1880000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[690]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-18T07:18:32.2650000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[691]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-18T07:18:33.2240000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[692]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-18T07:18:33.2240000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[693]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-18T07:18:33.2240000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[694]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-18T07:18:33.2250000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[695]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-18T07:18:33.3250000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[696]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-18T07:18:33.3270000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[697]
  Log Name: System
  Source: LsaSrv
  Date: 2025-09-18T07:18:33.3790000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[698]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-18T07:18:33.5780000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[699]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-18T07:18:33.5910000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[700]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-18T07:18:33.5910000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[701]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T07:18:34.5650000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[702]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T07:18:34.5750000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[703]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T07:18:34.5970000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[704]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T07:18:34.6020000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[705]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T07:18:34.6210000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[706]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T07:18:34.6210000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[707]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T07:18:34.6210000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[708]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T07:18:34.6270000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[709]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T07:18:34.6350000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[710]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T07:18:34.6430000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[711]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-18T07:18:34.9670000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[712]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-18T07:18:34.9680000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[713]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-18T07:18:34.9680000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[714]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-18T07:18:35.0190000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[715]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-18T07:18:35.2110000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[716]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T07:18:35.2460000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[717]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T07:18:35.2460000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[718]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T07:18:35.2460000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[719]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T07:18:35.2460000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[720]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T07:18:35.2460000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[721]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T07:18:35.2460000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[722]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T07:18:35.2460000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[723]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T07:18:35.2460000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[724]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T07:18:35.2460000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[725]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T07:18:35.2460000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[726]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T07:18:35.2460000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[727]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T07:18:35.2460000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[728]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T07:18:35.2460000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[729]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T07:18:35.2460000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[730]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-18T07:18:35.6040000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[731]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-18T07:18:36.9720000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[732]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-18T07:18:36.9720000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000014-0000000000.json for detailed information on what checks were made. 

Event[733]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-18T07:18:37.2180000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[734]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-18T07:18:37.3520000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[735]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-18T07:18:37.3870000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[736]
  Log Name: System
  Source: TPM
  Date: 2025-09-18T07:18:40.2220000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[737]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-18T07:18:40.8950000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[738]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-18T07:18:41.6610000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[739]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-18T07:18:43.6230000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[740]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-18T07:19:06.9060000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[741]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T07:19:42.6900000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[742]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T07:19:42.6940000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[743]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T07:19:42.7100000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[744]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T07:19:42.7100000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[745]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T07:19:42.7100000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[746]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T07:19:42.7100000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[747]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T07:19:42.7100000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[748]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T07:19:42.7100000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[749]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-18T07:20:38.9170000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[750]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-18T07:20:38.9170000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[751]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-18T07:20:38.9170000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[752]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-18T07:20:45.5890000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[753]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-18T07:23:09.3410000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[754]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-18T07:23:35.3530000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[755]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-18T07:23:35.3530000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[756]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-18T07:25:17.3800000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[757]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-18T07:25:17.3830000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[758]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-18T07:25:17.3840000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[759]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-18T07:25:17.3850000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[760]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-18T07:26:14.3430000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[761]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T07:39:22.3450000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[762]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-18T07:39:49.4010000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[763]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-18T07:50:58.0070000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[764]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-18T07:51:00.8910000Z
  Event ID: 7011
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7011 - radio ON 

Event[765]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-18T07:51:08.0750000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[766]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-18T07:51:38.2120000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[767]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-18T07:55:59.7340000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[768]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-18T07:56:29.8990000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[769]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-18T07:56:30.0450000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[770]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-18T07:59:10.7320000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[771]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-18T08:01:42.0930000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[772]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-18T08:05:54.6300000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  Bonjour Service
Service File Name:  "C:\Program Files\Bonjour\mDNSResponder.exe"
Service Type:  user mode service
Service Start Type:  auto start
Service Account:  LocalSystem 

Event[773]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-18T08:06:27.7730000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  iPod Service
Service File Name:  "C:\Program Files\iPod\bin\iPodService.exe"
Service Type:  user mode service
Service Start Type:  demand start
Service Account:  LocalSystem 

Event[774]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-18T08:13:49.9310000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[775]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-18T08:30:53.9320000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[776]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-18T08:35:11.5900000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[777]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-18T08:41:37.7630000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[778]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-18T08:43:36.9540000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[779]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-18T08:46:57.0280000Z
  Event ID: 7011
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7011 - radio ON 

Event[780]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-18T08:47:57.9360000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[781]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-18T09:05:01.9400000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[782]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-18T10:05:54.1910000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[783]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-18T10:07:12.6660000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[784]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-18T10:08:07.8100000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[785]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-18T10:10:25.6940000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name rr2---sn-8vq54voxpo-cvhe.googlevideo.com timed out after none of the configured DNS servers responded. Client PID 5864. 

Event[786]
  Log Name: System
  Source: EventLog
  Date: 2025-09-18T10:30:00.7220000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 11491 seconds. 

Event[787]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-18T10:39:04.3680000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAppRuntime.1.7_7000.617.2103.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[788]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-18T10:39:15.4210000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name array514.prod.do.dsp.mp.microsoft.com timed out after none of the configured DNS servers responded. Client PID 7508. 

Event[789]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-18T10:42:12.4940000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[790]
  Log Name: System
  Source: User32
  Date: 2025-09-18T10:50:05.4620000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the restart of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: restart
 Comment:  

Event[791]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-18T10:50:06.3680000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[792]
  Log Name: System
  Source: EventLog
  Date: 2025-09-18T10:50:07.8500000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[793]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-18T10:50:07.7870000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[794]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-18T10:50:07.8380000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[795]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-18T10:50:07.8380000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[796]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-18T10:50:07.8400000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[797]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-18T10:50:07.8420000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[798]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-18T10:50:07.8420000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[799]
  Log Name: System
  Source: EventLog
  Date: 2025-09-18T10:50:22.7150000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[800]
  Log Name: System
  Source: EventLog
  Date: 2025-09-18T10:50:22.7160000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[801]
  Log Name: System
  Source: EventLog
  Date: 2025-09-18T10:50:22.7170000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[802]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-18T10:50:08.0370000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[803]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-18T10:50:08.0600000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[804]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T10:50:08.3280000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Reboot 
Event Code: 0x0 
Reason: Kernel API 

Event[805]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-18T10:50:08.7970000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[806]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-18T10:50:08.7970000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[807]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T10:50:10.7870000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[808]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-18T10:50:11.0600000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?09?-?18T06:50:11.060253600Z. 

Event[809]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-18T10:50:17.8990000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?09?-?18T06:50:17.500000000Z. 

Event[810]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-18T10:50:17.8990000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?09?-?18T06:50:17.500000000Z. 

Loader time: ?2025?-?09?-?18T06:50:16.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[811]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-18T10:50:17.8990000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[812]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-18T10:50:17.8990000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[813]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-18T10:50:17.8990000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[814]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-18T10:50:17.9000000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[815]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-18T10:50:17.9000000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[816]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-18T10:50:17.9000000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?09?-?18T12:20:16.000000000Z. 

Event[817]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-18T10:50:17.9000000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[818]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-18T10:50:17.9000000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[819]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-18T10:50:17.9040000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[820]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-18T10:50:17.9040000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[821]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-09-18T10:50:17.9390000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[822]
  Log Name: System
  Source: Application Popup
  Date: 2025-09-18T10:50:18.1010000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[823]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T10:50:18.3090000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[824]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T10:50:18.3100000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[825]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T10:50:18.3110000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2020?-?11?-?18T22:54:15.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[826]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-18T10:50:18.7380000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[827]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T10:50:18.8320000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[828]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T10:50:18.8370000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[829]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T10:50:18.9430000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[830]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T10:50:18.9750000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[831]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T10:50:18.9750000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[832]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T10:50:18.9770000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[833]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-18T10:50:19.4580000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[834]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T10:50:19.5000000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[835]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T10:50:19.5090000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[836]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-18T10:50:19.5230000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[837]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-18T10:50:19.5230000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[838]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T10:50:19.5270000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[839]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T10:50:19.5300000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[840]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T10:50:19.5310000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[841]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T10:50:19.5320000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[842]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T10:50:19.5330000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[843]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T10:50:19.6270000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[844]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-18T10:50:19.6300000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[845]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T10:50:19.6320000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[846]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T10:50:19.7010000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[847]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-18T10:50:20.0880000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[848]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-18T10:50:20.1510000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[849]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-18T10:50:21.2680000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[850]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-18T10:50:21.2680000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[851]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-18T10:50:21.2680000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[852]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-18T10:50:21.2690000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[853]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-18T10:50:21.3630000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[854]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-18T10:50:21.3640000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[855]
  Log Name: System
  Source: LsaSrv
  Date: 2025-09-18T10:50:21.4170000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[856]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-18T10:50:21.5930000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[857]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-18T10:50:21.6050000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[858]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-18T10:50:21.6050000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[859]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T10:50:22.5450000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[860]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T10:50:22.5550000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[861]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T10:50:22.5770000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[862]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T10:50:22.5870000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[863]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T10:50:22.5990000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[864]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T10:50:22.6150000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[865]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T10:50:22.6150000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[866]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T10:50:22.6150000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[867]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T10:50:22.6230000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[868]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T10:50:22.6310000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[869]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-18T10:50:22.9110000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[870]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-18T10:50:22.9110000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[871]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-18T10:50:22.9110000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[872]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-18T10:50:22.9540000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[873]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T10:50:23.1930000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[874]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T10:50:23.1930000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[875]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T10:50:23.1930000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[876]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T10:50:23.1930000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[877]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T10:50:23.1930000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[878]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T10:50:23.1930000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[879]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T10:50:23.1930000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[880]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T10:50:23.1930000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[881]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T10:50:23.1930000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[882]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T10:50:23.1930000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[883]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T10:50:23.1930000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[884]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T10:50:23.1930000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[885]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T10:50:23.1930000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[886]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-18T10:50:23.1930000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[887]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-18T10:50:23.2060000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[888]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-18T10:50:23.6360000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[889]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-18T10:50:24.9490000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[890]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-18T10:50:24.9490000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000015-0000000000.json for detailed information on what checks were made. 

Event[891]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-18T10:50:25.3410000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[892]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-18T10:50:25.4780000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[893]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-18T10:50:25.5180000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[894]
  Log Name: System
  Source: TPM
  Date: 2025-09-18T10:50:28.2220000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[895]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-18T10:50:29.6050000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[896]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-18T10:50:31.9370000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[897]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-18T10:50:53.6160000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[898]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T10:51:30.6690000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[899]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T10:51:30.6690000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[900]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T10:51:30.6850000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[901]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T10:51:30.6850000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[902]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T10:51:30.6850000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[903]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T10:51:30.6850000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[904]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T10:51:30.6850000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[905]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-18T10:51:30.6850000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[906]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-18T10:52:26.9020000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[907]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-18T10:52:26.9020000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[908]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-18T10:55:23.3070000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[909]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-18T10:55:23.3070000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[910]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-18T10:57:06.8050000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[911]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-18T10:57:06.8080000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[912]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-18T10:57:06.8090000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[913]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-18T10:57:06.8100000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[914]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-18T11:33:19.6510000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[915]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T12:22:03.3610000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[916]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-18T12:22:31.0060000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[917]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-18T12:22:36.2470000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[918]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-18T12:29:22.8060000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[919]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-18T12:29:30.5350000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[920]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-18T13:06:05.2540000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[921]
  Log Name: System
  Source: Tcpip
  Date: 2025-09-18T13:13:39.7180000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[922]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-18T13:30:04.6750000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[923]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-18T13:50:28.4150000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[924]
  Log Name: System
  Source: Tcpip
  Date: 2025-09-18T14:42:00.2220000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[925]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-09-18T15:48:45.5690000Z
  Event ID: 10121
  Task: User-mode Driver problems. 
  Level: Critical 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
A runtime failure has occurred in user-mode driver AppleUsbFilter.dll and the hosting process has been terminated. This may temporarily interrupt your ability to access the devices. Please contact the device manufacturer or driver vendor for more information about this problem. 

Event[926]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-09-18T15:48:45.5710000Z
  Event ID: 10120
  Task: User-mode Driver problems. 
  Level: Critical 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A problem has occurred with one or more user-mode drivers and the hosting process has been terminated.  This may temporarily interrupt your ability to access the devices. 

Event[927]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-09-18T15:48:45.6050000Z
  Event ID: 10116
  Task: User-mode Driver problems. 
  Level: Critical 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The device Apple iPhone (location 0000.0014.0000.003.000.000.000.000.000) is offline due to a user-mode driver crash.  Windows will attempt to restart the device in the shared process 1 more times before moving the device in its own process.  Please contact the device manufacturer for more information about this problem. 

Event[928]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-09-18T15:48:45.6060000Z
  Event ID: 10116
  Task: User-mode Driver problems. 
  Level: Critical 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The device Apple Mobile Device USB Device (location 0000.0014.0000.003.000.000.000.000.000) is offline due to a user-mode driver crash.  Windows will attempt to restart the device in the shared process 1 more times before moving the device in its own process.  Please contact the device manufacturer for more information about this problem. 

Event[929]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-18T15:49:16.1690000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[930]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-18T16:09:50.1790000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[931]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-18T16:10:14.5340000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[932]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-18T16:11:33.9380000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[933]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-18T16:11:38.9170000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[934]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-18T16:13:01.6170000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Update for Microsoft Defender Antivirus antimalware platform - KB4052623 (Version 4.18.25080.5) - Current Channel (Broad) 

Event[935]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T16:13:08.4150000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (Version 10.0, ?2020?-?11?-?18T22:54:15.000000000Z) unloaded successfully. 

Event[936]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-18T16:13:15.0700000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[937]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-18T16:13:15.1070000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  KslD
Service File Name:  system32\drivers\wd\KslD.sys
Service Type:  kernel mode driver
Service Start Type:  demand start
Service Account:   

Event[938]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-18T16:13:22.8710000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Update for Microsoft Defender Antivirus antimalware platform - KB4052623 (Version 4.18.25080.5) - Current Channel (Broad) 

Event[939]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-18T16:13:23.5620000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.25.0) - Current Channel (Broad) 

Event[940]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-18T16:14:07.1980000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.25.0) - Current Channel (Broad) 

Event[941]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-18T16:21:56.4600000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[942]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-18T16:26:02.5450000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[943]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-18T16:28:06.8470000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[944]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T17:10:35.7610000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[945]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T17:10:41.0940000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 0 to 1.

Reason SessionUnlock 

BootId: 15 

Event[946]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T17:10:41.0970000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 1 to 3.

Reason SxTransition 

BootId: 15 

Event[947]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T17:10:43.8380000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[948]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T17:10:45.6740000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[949]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-18T17:10:48.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?09?-?18T13:10:48.500000000Z from ?2025?-?09?-?18T13:10:45.673975000Z.
Time Delta: 2826 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?09?-?18T18:40:48.500000000Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[950]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T17:10:48.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 1, FullResume: 740, AverageResume: 740 

Event[951]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T17:10:48.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 22828853, SuspendEnd: 22828854 

Event[952]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T17:10:48.6740000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 3 to 4.

Reason SxTransition 

BootId: 15 

Event[953]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T17:10:49.3810000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 4 to 6.

Reason Unknown 

BootId: 15 

Event[954]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-09-18T17:10:49.7100000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?09?-?18T13:10:41.096679400Z
Wake Time: ?2025?-?09?-?18T13:10:48.681590000Z

Wake Source: Power Button 

Event[955]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T17:11:48.7270000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 6 to 7.

Reason SessionUnlock 

BootId: 15 

Event[956]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T17:12:32.7770000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[957]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T17:12:32.8020000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 7 to 9.

Reason AcDcBurst 

BootId: 15 

Event[958]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T17:12:38.5710000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 9 to 10.

Reason AcDcBurst 

BootId: 15 

Event[959]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T17:16:17.4520000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[960]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T17:16:17.4950000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 10 to 12.

Reason AcDcBurst 

BootId: 15 

Event[961]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T17:16:19.4670000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[962]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T17:16:25.2250000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 12 to 13.

Reason AcDcBurst 

BootId: 15 

Event[963]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T17:19:14.0980000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 13 to 15.

Reason InputHid 

BootId: 15 

Event[964]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-18T17:21:28.8580000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[965]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-18T17:46:09.4100000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[966]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-18T17:57:40.3680000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[967]
  Log Name: System
  Source: User32
  Date: 2025-09-18T18:03:07.4160000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[968]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-18T18:03:08.3800000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[969]
  Log Name: System
  Source: EventLog
  Date: 2025-09-18T18:03:08.8390000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[970]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-18T18:03:08.7810000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[971]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-18T18:03:08.8250000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[972]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-18T18:03:08.8260000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[973]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-18T18:03:08.8270000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[974]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-18T18:03:08.8350000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[975]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-18T18:03:08.8350000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[976]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-18T18:03:09.0210000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[977]
  Log Name: System
  Source: EventLog
  Date: 2025-09-19T07:35:30.8090000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[978]
  Log Name: System
  Source: EventLog
  Date: 2025-09-19T07:35:30.8090000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[979]
  Log Name: System
  Source: EventLog
  Date: 2025-09-19T07:35:30.8100000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[980]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-18T18:03:09.0410000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[981]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T18:03:09.2710000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[982]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-18T18:03:09.7970000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[983]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-18T18:03:09.7970000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[984]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-18T18:03:10.5230000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[985]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-18T18:03:10.7580000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?09?-?18T14:03:10.758046400Z. 

Event[986]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-19T07:35:25.9060000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?09?-?19T03:35:25.500000000Z. 

Event[987]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-19T07:35:25.9060000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?09?-?19T03:35:25.500000000Z. 

Loader time: ?2025?-?09?-?19T03:35:24.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[988]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-19T07:35:25.9070000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[989]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-19T07:35:25.9070000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[990]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-19T07:35:25.9070000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[991]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-19T07:35:25.9070000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[992]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-19T07:35:25.9070000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[993]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-19T07:35:25.9070000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?09?-?19T09:05:24.000000000Z. 

Event[994]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-19T07:35:25.9070000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[995]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-19T07:35:25.9070000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[996]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-19T07:35:25.9110000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[997]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-19T07:35:25.9110000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[998]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-09-19T07:35:25.9490000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[999]
  Log Name: System
  Source: Application Popup
  Date: 2025-09-19T07:35:26.0990000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[1000]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-19T07:35:26.3040000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1001]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-19T07:35:26.3050000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1002]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-19T07:35:26.3060000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1003]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-19T07:35:26.7820000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[1004]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-19T07:35:26.8930000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1005]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-19T07:35:26.8980000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1006]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-19T07:35:27.0090000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1007]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-19T07:35:27.0420000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[1008]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-19T07:35:27.0420000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[1009]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-19T07:35:27.0440000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[1010]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-19T07:35:27.5480000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[1011]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-19T07:35:27.5890000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1012]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-19T07:35:27.5980000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1013]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-19T07:35:27.6120000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1014]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-19T07:35:27.6110000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[1015]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-19T07:35:27.6110000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[1016]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-19T07:35:27.6130000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1017]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-19T07:35:27.6170000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1018]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-19T07:35:27.6180000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1019]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-19T07:35:27.6200000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1020]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-19T07:35:27.6990000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1021]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-19T07:35:27.7130000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[1022]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-19T07:35:27.7500000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[1023]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-19T07:35:27.8180000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[1024]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-19T07:35:28.2220000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[1025]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-19T07:35:28.2940000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[1026]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-19T07:35:29.3520000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[1027]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-19T07:35:29.3520000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[1028]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-19T07:35:29.3520000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[1029]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-19T07:35:29.3530000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[1030]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-19T07:35:29.4530000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[1031]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-19T07:35:29.4550000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[1032]
  Log Name: System
  Source: LsaSrv
  Date: 2025-09-19T07:35:29.5090000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[1033]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-19T07:35:29.6940000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[1034]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-19T07:35:29.7070000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[1035]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-19T07:35:29.7070000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[1036]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-19T07:35:30.6590000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1037]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-19T07:35:30.6700000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1038]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-19T07:35:30.6760000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1039]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-19T07:35:30.6840000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1040]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-19T07:35:30.7120000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1041]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-19T07:35:30.7120000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[1042]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-19T07:35:30.7130000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1043]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-19T07:35:30.7190000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1044]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-19T07:35:30.7260000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1045]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-19T07:35:30.7340000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1046]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-19T07:35:31.0340000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[1047]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-19T07:35:31.0340000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[1048]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-19T07:35:31.0340000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[1049]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-19T07:35:31.0630000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[1050]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-19T07:35:31.3080000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[1051]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-19T07:35:31.3250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1052]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-19T07:35:31.3250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1053]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-19T07:35:31.3250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1054]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-19T07:35:31.3250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1055]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-19T07:35:31.3250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1056]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-19T07:35:31.3250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1057]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-19T07:35:31.3250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1058]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-19T07:35:31.3250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1059]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-19T07:35:31.3250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1060]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-19T07:35:31.3250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1061]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-19T07:35:31.3250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1062]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-19T07:35:31.3250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1063]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-19T07:35:31.3250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1064]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-19T07:35:31.3250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1065]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-19T07:35:31.6940000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[1066]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-19T07:35:32.9810000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[1067]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-19T07:35:32.9810000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000016-0000000000.json for detailed information on what checks were made. 

Event[1068]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-19T07:35:33.2950000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[1069]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-19T07:35:33.4310000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[1070]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-19T07:35:33.4630000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[1071]
  Log Name: System
  Source: TPM
  Date: 2025-09-19T07:35:36.2210000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[1072]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-19T07:35:36.9950000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[1073]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-19T07:35:37.5200000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[1074]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-19T07:35:39.0730000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[1075]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-19T07:35:54.5010000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1076]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-19T07:36:14.2410000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1077]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-19T07:36:38.7600000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1078]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-19T07:36:38.7600000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1079]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-19T07:36:38.7760000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1080]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-19T07:36:38.7760000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1081]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-19T07:36:38.7760000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1082]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-19T07:36:38.7760000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1083]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-19T07:36:38.7760000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1084]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-19T07:36:38.7910000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1085]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-19T07:37:34.9420000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1086]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-19T07:37:34.9420000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1087]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-19T07:37:41.7230000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[1088]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-19T07:38:07.9790000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[1089]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-19T07:40:31.4520000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[1090]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-19T07:40:31.4520000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[1091]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-19T07:40:38.1270000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[1092]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-19T07:42:44.4980000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[1093]
  Log Name: System
  Source: User32
  Date: 2025-09-19T07:44:24.0190000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[1094]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-19T07:44:24.7780000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[1095]
  Log Name: System
  Source: EventLog
  Date: 2025-09-19T07:44:26.3400000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[1096]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-19T07:44:26.0020000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[1097]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-19T07:44:26.2700000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[1098]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-19T07:44:26.3300000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[1099]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-19T07:44:26.3300000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[1100]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-19T07:44:26.3310000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[1101]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-19T07:44:26.3310000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[1102]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-19T07:44:26.3310000Z
  Event ID: 51057
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service stop is almost done.DHCP Context Ref count is 1 

Event[1103]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-19T07:44:26.3320000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[1104]
  Log Name: System
  Source: EventLog
  Date: 2025-09-21T13:53:44.0870000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[1105]
  Log Name: System
  Source: EventLog
  Date: 2025-09-21T13:53:44.0880000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[1106]
  Log Name: System
  Source: EventLog
  Date: 2025-09-21T13:53:44.0890000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[1107]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-19T07:44:26.5320000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[1108]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-19T07:44:26.5770000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[1109]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-19T07:44:26.7970000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[1110]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-19T07:44:27.2720000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[1111]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-19T07:44:27.2720000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[1112]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-19T07:44:29.1110000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[1113]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-19T07:44:29.4200000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?09?-?19T03:44:29.420251400Z. 

Event[1114]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T13:53:38.8950000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?09?-?21T09:53:38.500000000Z. 

Event[1115]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T13:53:38.8950000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?09?-?21T09:53:38.500000000Z. 

Loader time: ?2025?-?09?-?21T09:53:37.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[1116]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-21T13:53:38.8950000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[1117]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-21T13:53:38.8950000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[1118]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-21T13:53:38.8950000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[1119]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-21T13:53:38.8950000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[1120]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-21T13:53:38.8950000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[1121]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-21T13:53:38.8960000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?09?-?21T15:23:37.000000000Z. 

Event[1122]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-21T13:53:38.8960000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[1123]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-21T13:53:38.8960000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[1124]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-21T13:53:38.8990000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[1125]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T13:53:38.9000000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[1126]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-09-21T13:53:38.9370000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[1127]
  Log Name: System
  Source: Application Popup
  Date: 2025-09-21T13:53:39.0870000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[1128]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T13:53:39.3040000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1129]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T13:53:39.3050000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1130]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T13:53:39.3060000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1131]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-21T13:53:39.7500000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[1132]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T13:53:39.9000000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1133]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T13:53:39.9070000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1134]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T13:53:40.0440000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1135]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T13:53:40.0800000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[1136]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T13:53:40.0800000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[1137]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T13:53:40.0820000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[1138]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-21T13:53:40.6740000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[1139]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T13:53:40.7150000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1140]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T13:53:40.7250000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1141]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T13:53:40.7330000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1142]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T13:53:40.7350000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1143]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T13:53:40.7400000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1144]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-21T13:53:40.7400000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[1145]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-21T13:53:40.7400000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[1146]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T13:53:40.7430000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1147]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T13:53:40.7450000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1148]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T13:53:40.7660000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1149]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-21T13:53:40.7830000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[1150]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T13:53:40.8000000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[1151]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T13:53:40.8640000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[1152]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T13:53:40.8650000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[1153]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-21T13:53:41.3270000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[1154]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T13:53:41.3920000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[1155]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-21T13:53:42.4960000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[1156]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-21T13:53:42.4960000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[1157]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-21T13:53:42.4960000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[1158]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-21T13:53:42.5000000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[1159]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-21T13:53:42.6470000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[1160]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-21T13:53:42.6480000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[1161]
  Log Name: System
  Source: LsaSrv
  Date: 2025-09-21T13:53:42.7310000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[1162]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-21T13:53:42.9860000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[1163]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-21T13:53:42.9960000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[1164]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-21T13:53:42.9960000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[1165]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T13:53:43.9310000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1166]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T13:53:43.9400000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1167]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T13:53:43.9500000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1168]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T13:53:43.9650000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1169]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T13:53:43.9860000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1170]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T13:53:43.9860000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[1171]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T13:53:43.9860000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1172]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T13:53:43.9920000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1173]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T13:53:43.9990000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1174]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T13:53:44.0070000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1175]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-21T13:53:44.2850000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[1176]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-21T13:53:44.2850000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[1177]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-21T13:53:44.2850000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[1178]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-21T13:53:44.3210000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[1179]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T13:53:44.5600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1180]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T13:53:44.5600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1181]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T13:53:44.5600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1182]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T13:53:44.5600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1183]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T13:53:44.5600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1184]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T13:53:44.5600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1185]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T13:53:44.5600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1186]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T13:53:44.5600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1187]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T13:53:44.5600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1188]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T13:53:44.5600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1189]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T13:53:44.5600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1190]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T13:53:44.5600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1191]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T13:53:44.5600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1192]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T13:53:44.5600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1193]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-21T13:53:44.5920000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[1194]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-21T13:53:44.9090000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[1195]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-21T13:53:46.5810000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[1196]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-21T13:53:46.5810000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000017-0000000000.json for detailed information on what checks were made. 

Event[1197]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-21T13:53:46.8450000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[1198]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-21T13:53:46.9930000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[1199]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-21T13:53:47.0310000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[1200]
  Log Name: System
  Source: TPM
  Date: 2025-09-21T13:53:49.2030000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[1201]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-21T13:53:50.6840000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[1202]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-21T13:53:50.7340000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[1203]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-21T13:53:52.5830000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[1204]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-21T13:54:13.6720000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1205]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T13:54:51.8750000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1206]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T13:54:51.8910000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1207]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T13:54:51.8910000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1208]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T13:54:51.9060000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1209]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T13:54:51.9060000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1210]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T13:54:51.9060000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1211]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T13:54:51.9060000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1212]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T13:54:51.9060000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1213]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T13:54:53.1710000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 0 to 1.

Reason SessionUnlock 

BootId: 17 

Event[1214]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-21T13:55:48.7920000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1215]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-21T13:55:48.7920000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1216]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-21T13:55:48.7920000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1217]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-21T13:55:55.3900000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[1218]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T13:57:44.6560000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 1 to 3.

Reason InputHid 

BootId: 17 

Event[1219]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-21T13:57:57.3730000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1220]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-21T13:57:57.3750000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1221]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-21T13:57:57.3770000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1222]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-21T13:57:57.3780000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1223]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T13:58:14.9620000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1224]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-21T13:58:44.7550000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[1225]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-21T13:58:44.7550000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[1226]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-21T14:03:30.2550000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[1227]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-21T14:06:29.2910000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[1228]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-21T14:06:41.3960000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.80.0) - Current Channel (Broad) 

Event[1229]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-21T14:06:52.3510000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.80.0) - Current Channel (Broad) 

Event[1230]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-21T14:10:56.0080000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[1231]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-21T14:12:51.3050000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[1232]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-21T14:13:00.6840000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[1233]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T14:14:35.0700000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[1234]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T14:14:38.1220000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 3 to 4.

Reason SessionUnlock 

BootId: 17 

Event[1235]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-21T14:14:38.6800000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[1236]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T14:15:00.9540000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 4 to 6.

Reason InputHid 

BootId: 17 

Event[1237]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-21T14:15:57.2440000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[1238]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T14:16:00.5590000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.OfficePushNotificationUtility_16.0.19127.20222_neutral__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[1239]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T14:16:01.9320000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Office.ActionsServer_16.0.19127.20222_neutral__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[1240]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T14:19:55.9320000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 6 to 7.

Reason SessionUnlock 

BootId: 17 

Event[1241]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T14:26:14.4710000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 7 to 9.

Reason InputHid 

BootId: 17 

Event[1242]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T14:27:27.3530000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.ZuneMusic_11.2508.31.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[1243]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-21T14:27:44.2840000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume ?? (\Device\HarddiskVolumeShadowCopy2) is healthy.  No action is needed. 

Event[1244]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-21T14:27:44.8210000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: 9WZDNCRFJ3PT-MICROSOFT.ZUNEMUSIC 

Event[1245]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-21T14:27:47.1540000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: 9WZDNCRFJ3PT-MICROSOFT.ZUNEMUSIC 

Event[1246]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-21T14:33:29.3600000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[1247]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-21T14:34:02.5530000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[1248]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-21T14:34:08.5590000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1249]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T14:47:05.1510000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[1250]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T14:50:14.7640000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat was cleared updating 5 keys and creating 1 modified pages. 

Event[1251]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-21T14:56:07.8820000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[1252]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-21T14:59:00.9110000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[1253]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T15:12:36.5090000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 9 to 10.

Reason SessionUnlock 

BootId: 17 

Event[1254]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T15:13:07.1540000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 10 to 12.

Reason InputAccelerometer 

BootId: 17 

Event[1255]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-21T15:16:40.4360000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[1256]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T15:28:28.1410000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 2 keys and creating 1 modified pages. 

Event[1257]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-21T15:42:01.5000000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[1258]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T15:46:27.1270000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 12 to 13.

Reason SessionUnlock 

BootId: 17 

Event[1259]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T15:49:38.8710000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 13 to 15.

Reason InputHid 

BootId: 17 

Event[1260]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-21T15:50:53.8790000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[1261]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T16:12:34.1880000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 15 to 16.

Reason SessionUnlock 

BootId: 17 

Event[1262]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T16:17:40.4730000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 16 to 18.

Reason SxTransition 

BootId: 17 

Event[1263]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T16:17:43.3580000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[1264]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T16:17:44.6640000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[1265]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:17:48.5010000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?09?-?21T12:17:48.500000000Z from ?2025?-?09?-?21T12:17:44.664134600Z.
Time Delta: 3835 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?09?-?21T17:47:48.500000000Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[1266]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T16:17:48.5010000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 1, FullResume: 743, AverageResume: 743 

Event[1267]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T16:17:48.5010000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 8651960, SuspendEnd: 8651961 

Event[1268]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T16:17:48.7170000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 18 to 19.

Reason SxTransition 

BootId: 17 

Event[1269]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T16:17:49.4900000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 19 to 21.

Reason Unknown 

BootId: 17 

Event[1270]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-09-21T16:17:51.6220000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?09?-?21T12:17:40.455241800Z
Wake Time: ?2025?-?09?-?21T12:17:48.781530100Z

Wake Source: Power Button 

Event[1271]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:17:52.4770000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages. 

Event[1272]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T16:18:52.8810000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 21 to 22.

Reason SessionUnlock 

BootId: 17 

Event[1273]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T16:19:34.7130000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 22 to 24.

Reason Austerity Battery Drain Budget Exceeded 

BootId: 17 

Event[1274]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T16:21:36.8840000Z
  Event ID: 524
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Critical Battery Trigger Met 

Event[1275]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T16:21:36.8880000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 24 to 26.

Reason Austerity Battery Drain Budget Exceeded 

BootId: 17 

Event[1276]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T16:21:36.8890000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 26 to 28.

Reason SxTransition 

BootId: 17 

Event[1277]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T16:21:37.8420000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: Battery 

Event[1278]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T16:21:42.4810000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[1279]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:38:30.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?09?-?21T12:38:30.500000000Z from ?2025?-?09?-?21T12:21:42.479442300Z.
Time Delta: 1008020 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?09?-?21T18:08:30.500000000Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[1280]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-21T16:38:30.7500000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[1281]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-21T16:38:30.7510000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x0. 

Event[1282]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-21T16:38:30.7510000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The boot type was 0x2. 

Event[1283]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-21T16:38:30.7510000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[1284]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-21T16:38:30.7510000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[1285]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-21T16:38:30.7510000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[1286]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T16:38:30.7670000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 28 to 29.

Reason SxTransition 

BootId: 17 

Event[1287]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T16:38:31.2970000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 29 to 31.

Reason WinRT 

BootId: 17 

Event[1288]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-09-21T16:38:32.9550000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?09?-?21T12:21:36.889186800Z
Wake Time: ?2025?-?09?-?21T12:38:30.805324200Z

Wake Source: Unknown 

Event[1289]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:38:41.3530000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \Device\HarddiskVolume1\EFI\Microsoft\Boot\BCD was cleared updating 83 keys and creating 6 modified pages. 

Event[1290]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-21T16:40:08.4470000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[1291]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:42:47.2190000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?09?-?21T12:42:46.500000000Z. 

Event[1292]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:42:47.2190000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?09?-?21T12:42:46.500000000Z. 

Loader time: ?2025?-?09?-?21T12:42:45.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[1293]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-21T16:42:47.2200000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[1294]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-21T16:42:47.2200000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[1295]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-21T16:42:47.2200000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[1296]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-21T16:42:47.2200000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was false. The last boot's success status was true. 

Event[1297]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-21T16:42:47.2200000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[1298]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-21T16:42:47.2200000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?09?-?21T18:12:45.000000000Z. 

Event[1299]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-21T16:42:47.2200000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[1300]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-21T16:42:47.2200000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[1301]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-21T16:42:47.2230000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[1302]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:42:47.2230000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[1303]
  Log Name: System
  Source: EventLog
  Date: 2025-09-21T16:42:55.5120000Z
  Event ID: 6008
  Task: None 
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The previous system shutdown at 6:10:36 PM on ?9/?21/?2025 was unexpected. 

Event[1304]
  Log Name: System
  Source: EventLog
  Date: 2025-09-21T16:42:55.5130000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[1305]
  Log Name: System
  Source: EventLog
  Date: 2025-09-21T16:42:55.5130000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[1306]
  Log Name: System
  Source: EventLog
  Date: 2025-09-21T16:42:55.5140000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 9 seconds. 

Event[1307]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-09-21T16:42:47.2440000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[1308]
  Log Name: System
  Source: Application Popup
  Date: 2025-09-21T16:42:47.3870000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[1309]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T16:42:47.6270000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1310]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T16:42:47.6280000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1311]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T16:42:47.6300000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1312]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-21T16:42:48.2920000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[1313]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T16:42:48.3930000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1314]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T16:42:48.3980000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1315]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T16:42:48.5050000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1316]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T16:42:48.5380000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[1317]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T16:42:48.5380000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[1318]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:42:48.5440000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \SystemRoot\System32\Config\SECURITY was cleared updating 80 keys and creating 4 modified pages. 

Event[1319]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:42:48.5440000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \SystemRoot\System32\Config\SAM was cleared updating 62 keys and creating 6 modified pages. 

Event[1320]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T16:42:48.5470000Z
  Event ID: 41
  Task: N/A
  Level: Critical 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly. 

Event[1321]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T16:42:48.5470000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[1322]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:42:48.6210000Z
  Event ID: 15
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Hive \SystemRoot\System32\Config\DEFAULT was reorganized with a starting size of 2539520 bytes and an ending size of 1966080 bytes. 

Event[1323]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-21T16:42:49.0230000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[1324]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T16:42:49.0640000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1325]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T16:42:49.0820000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1326]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T16:42:49.0830000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1327]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-21T16:42:49.0840000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[1328]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-21T16:42:49.0840000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[1329]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T16:42:49.0890000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1330]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T16:42:49.0910000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1331]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T16:42:49.0920000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1332]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T16:42:49.0930000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1333]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T16:42:49.1640000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1334]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T16:42:49.2260000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[1335]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-21T16:42:49.2400000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[1336]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T16:42:49.2830000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[1337]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-21T16:42:49.7530000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[1338]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:42:51.4550000Z
  Event ID: 15
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Hive \SystemRoot\System32\Config\SOFTWARE was reorganized with a starting size of 119521280 bytes and an ending size of 109936640 bytes. 

Event[1339]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:42:51.5110000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[1340]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-09-21T16:42:53.1960000Z
  Event ID: 10118
  Task: Startup of the UMDF reflector 
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
UMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts. 

Event[1341]
  Log Name: System
  Source: Microsoft-Windows-Kernel-PnP
  Date: 2025-09-21T16:42:53.1960000Z
  Event ID: 219
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The driver \Driver\WudfRd failed to load.
Device: USB\VID_05AC&PID_12A8&MI_00\6&302d0ec3&1&0000
Status: 0xC0000365 

Event[1342]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-21T16:42:53.8940000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[1343]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-21T16:42:53.8940000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[1344]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-21T16:42:53.8940000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[1345]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-21T16:42:53.8960000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[1346]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-21T16:42:54.0080000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[1347]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-21T16:42:54.0100000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[1348]
  Log Name: System
  Source: LsaSrv
  Date: 2025-09-21T16:42:54.0650000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[1349]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-21T16:42:54.2440000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[1350]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-21T16:42:54.2550000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[1351]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-21T16:42:54.2550000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[1352]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:42:54.3130000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\WINDOWS\ServiceProfiles\LocalService\NTUSER.DAT was cleared updating 180 keys and creating 22 modified pages. 

Event[1353]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:42:54.3950000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\WINDOWS\ServiceProfiles\NetworkService\NTUSER.DAT was cleared updating 161 keys and creating 18 modified pages. 

Event[1354]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:42:55.1270000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \SystemRoot\System32\Config\BBI was cleared updating 388 keys and creating 72 modified pages. 

Event[1355]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T16:42:55.2350000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1356]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T16:42:55.2410000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1357]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T16:42:55.2520000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1358]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T16:42:55.2700000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1359]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T16:42:55.2940000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1360]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T16:42:55.2940000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[1361]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T16:42:55.2940000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1362]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T16:42:55.2990000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1363]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T16:42:55.3080000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1364]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T16:42:55.3200000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1365]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-21T16:42:55.5970000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[1366]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-21T16:42:55.5970000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[1367]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-21T16:42:55.5970000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[1368]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-21T16:42:55.6250000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[1369]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T16:42:55.8810000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1370]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T16:42:55.8810000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1371]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T16:42:55.8810000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1372]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T16:42:55.8810000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1373]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T16:42:55.8810000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1374]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T16:42:55.8810000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1375]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T16:42:55.8810000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1376]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T16:42:55.8810000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1377]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T16:42:55.8810000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1378]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T16:42:55.8810000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1379]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T16:42:55.8810000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1380]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T16:42:55.8810000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1381]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T16:42:55.8810000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1382]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-21T16:42:55.8810000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1383]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:42:55.9840000Z
  Event ID: 15
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Hive \SystemRoot\System32\config\DRIVERS was reorganized with a starting size of 13750272 bytes and an ending size of 11595776 bytes. 

Event[1384]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-21T16:42:56.2990000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[1385]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-21T16:42:58.2230000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[1386]
  Log Name: System
  Source: TPM
  Date: 2025-09-21T16:42:58.2400000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[1387]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:42:58.3920000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\WINDOWS\AppCompat\Programs\Amcache.hve was cleared updating 1775 keys and creating 619 modified pages. 

Event[1388]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-21T16:42:58.4230000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[1389]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-21T16:42:58.5060000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[1390]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-21T16:42:59.2960000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[1391]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-21T16:42:59.2960000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000018-0000000000.json for detailed information on what checks were made. 

Event[1392]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-21T16:43:03.9710000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[1393]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:43:04.0990000Z
  Event ID: 15
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Hive \??\C:\Users\aaron\ntuser.dat was reorganized with a starting size of 10399744 bytes and an ending size of 9932800 bytes. 

Event[1394]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:43:04.1490000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Microsoft\Windows\UsrClass.dat was cleared updating 5052 keys and creating 479 modified pages. 

Event[1395]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-21T16:43:05.5630000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[1396]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:43:06.8830000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat was cleared updating 89 keys and creating 10 modified pages. 

Event[1397]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:43:06.9770000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\User.dat was cleared updating 33 keys and creating 4 modified pages. 

Event[1398]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:43:06.9840000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\UserClasses.dat was cleared updating 12 keys and creating 1 modified pages. 

Event[1399]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-21T16:43:06.9940000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[1400]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:43:07.5490000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat was cleared updating 16 keys and creating 1 modified pages. 

Event[1401]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-21T16:43:33.0080000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1402]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:43:35.4370000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 19 keys and creating 4 modified pages. 

Event[1403]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-21T16:43:39.6540000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1404]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T16:44:00.2270000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1405]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T16:44:00.2440000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1406]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T16:44:00.2440000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1407]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T16:44:00.2440000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1408]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T16:44:00.2620000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1409]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T16:44:00.2620000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1410]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T16:44:00.2620000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1411]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-21T16:44:00.2620000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1412]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:44:09.7830000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\Settings\settings.dat was cleared updating 6 keys and creating 1 modified pages. 

Event[1413]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:44:58.6450000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\dosvcState.dat was cleared updating 53 keys and creating 17 modified pages. 

Event[1414]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-21T16:45:00.0280000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1415]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-21T16:45:00.0280000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1416]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-21T16:45:00.0280000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1417]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-21T16:45:31.7560000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[1418]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-21T16:47:56.0090000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[1419]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-21T16:47:56.0090000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[1420]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-21T16:50:56.4150000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1421]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-21T16:50:56.4170000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1422]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-21T16:50:56.4170000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1423]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-21T16:50:56.4200000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1424]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-21T16:53:18.1980000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[1425]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-21T16:53:56.1860000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.82.0) - Current Channel (Broad) 

Event[1426]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-21T16:54:06.6470000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.82.0) - Current Channel (Broad) 

Event[1427]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:54:16.8060000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\SystemAppData\Helium\User.dat was cleared updating 20 keys and creating 2 modified pages. 

Event[1428]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T16:54:16.8100000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat was cleared updating 39 keys and creating 4 modified pages. 

Event[1429]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-21T16:54:30.5790000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1430]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-21T17:04:41.3190000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[1431]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T17:07:41.5560000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[1432]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T17:09:57.9590000Z
  Event ID: 15
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Hive \??\C:\WINDOWS\System32\config\COMPONENTS was reorganized with a starting size of 51236864 bytes and an ending size of 49799168 bytes. 

Event[1433]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T17:09:59.2800000Z
  Event ID: 15
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Hive \??\C:\WINDOWS\System32\SMI\Store\Machine\schema.dat was reorganized with a starting size of 17784832 bytes and an ending size of 10735616 bytes. 

Event[1434]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-21T17:09:59.7010000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from demand start to auto start. 

Event[1435]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-21T17:09:59.7390000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from auto start to demand start. 

Event[1436]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-21T17:10:10.3760000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from demand start to auto start. 

Event[1437]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T17:13:05.3200000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat was cleared updating 252 keys and creating 22 modified pages. 

Event[1438]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-21T17:14:10.5000000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[1439]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-21T17:23:02.5230000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[1440]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-21T17:31:13.9940000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container MicrosoftWindows.Client.WebExperience_525.24401.50.0_x64__cw5n1h2txyewy SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1441]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-21T17:38:26.0570000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1442]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T17:52:25.3540000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages. 

Event[1443]
  Log Name: System
  Source: User32
  Date: 2025-09-21T18:00:46.5440000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[1444]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-21T18:00:47.2610000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[1445]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-21T18:00:47.4440000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[1446]
  Log Name: System
  Source: EventLog
  Date: 2025-09-21T18:00:52.7260000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[1447]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-21T18:00:52.6460000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[1448]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-21T18:00:52.7170000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[1449]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-21T18:00:52.7170000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[1450]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-21T18:00:52.7180000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[1451]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-21T18:00:52.7190000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[1452]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-21T18:00:52.7280000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[1453]
  Log Name: System
  Source: EventLog
  Date: 2025-09-22T07:34:35.1940000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[1454]
  Log Name: System
  Source: EventLog
  Date: 2025-09-22T07:34:35.1950000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[1455]
  Log Name: System
  Source: EventLog
  Date: 2025-09-22T07:34:35.2060000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[1456]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-21T18:00:52.8840000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[1457]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-21T18:00:52.9050000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[1458]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-21T18:00:53.6480000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[1459]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-21T18:00:53.6480000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[1460]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T18:00:53.9550000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[1461]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-21T18:00:56.3460000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[1462]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-21T18:00:56.6440000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?09?-?21T14:00:56.644114200Z. 

Event[1463]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-22T07:34:29.8880000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?09?-?22T03:34:29.500000000Z. 

Event[1464]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-22T07:34:29.8880000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?09?-?22T03:34:29.500000000Z. 

Loader time: ?2025?-?09?-?22T03:34:28.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[1465]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-22T07:34:29.8880000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[1466]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-22T07:34:29.8880000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[1467]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-22T07:34:29.8890000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[1468]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-22T07:34:29.8890000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[1469]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-22T07:34:29.8890000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[1470]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-22T07:34:29.8890000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?09?-?22T09:04:28.000000000Z. 

Event[1471]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-22T07:34:29.8890000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[1472]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-22T07:34:29.8890000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[1473]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-22T07:34:29.8930000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[1474]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-22T07:34:29.8930000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[1475]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-09-22T07:34:29.9290000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[1476]
  Log Name: System
  Source: Application Popup
  Date: 2025-09-22T07:34:30.0760000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[1477]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-22T07:34:30.2860000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1478]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-22T07:34:30.2870000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1479]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-22T07:34:30.2880000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1480]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-22T07:34:30.8610000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[1481]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-22T07:34:31.0440000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1482]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-22T07:34:31.0540000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1483]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-22T07:34:31.2150000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1484]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-22T07:34:31.2570000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[1485]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-22T07:34:31.2570000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[1486]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-22T07:34:31.2590000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[1487]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-22T07:34:31.8140000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[1488]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-22T07:34:31.8530000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1489]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-22T07:34:31.8620000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1490]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-22T07:34:31.8630000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1491]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-22T07:34:31.8770000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1492]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-22T07:34:31.8780000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[1493]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-22T07:34:31.8790000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1494]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-22T07:34:31.8780000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[1495]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-22T07:34:31.8820000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1496]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-22T07:34:31.8830000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1497]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-22T07:34:31.8900000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1498]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-22T07:34:31.8940000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[1499]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-22T07:34:31.9530000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[1500]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-22T07:34:31.9550000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[1501]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-22T07:34:32.7030000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[1502]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-22T07:34:32.7790000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[1503]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-22T07:34:33.7470000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[1504]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-22T07:34:33.7470000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[1505]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-22T07:34:33.7470000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[1506]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-22T07:34:33.7480000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[1507]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-22T07:34:33.8520000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[1508]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-22T07:34:33.8530000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[1509]
  Log Name: System
  Source: LsaSrv
  Date: 2025-09-22T07:34:33.9080000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[1510]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-22T07:34:34.0840000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[1511]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-22T07:34:34.0960000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[1512]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-22T07:34:34.0960000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[1513]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-22T07:34:35.0270000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1514]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-22T07:34:35.0330000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1515]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-22T07:34:35.0400000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1516]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-22T07:34:35.0650000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1517]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-22T07:34:35.0840000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1518]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-22T07:34:35.0840000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[1519]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-22T07:34:35.0840000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1520]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-22T07:34:35.0900000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1521]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-22T07:34:35.1000000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1522]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-22T07:34:35.1080000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1523]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-22T07:34:35.4080000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[1524]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-22T07:34:35.4080000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[1525]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-22T07:34:35.4090000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[1526]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-22T07:34:35.4340000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[1527]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-22T07:34:35.6020000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1528]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-22T07:34:35.6020000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1529]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-22T07:34:35.6020000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1530]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-22T07:34:35.6020000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1531]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-22T07:34:35.6020000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1532]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-22T07:34:35.6020000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1533]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-22T07:34:35.6020000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1534]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-22T07:34:35.6020000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1535]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-22T07:34:35.6020000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1536]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-22T07:34:35.6020000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1537]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-22T07:34:35.6020000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1538]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-22T07:34:35.6020000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1539]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-22T07:34:35.6020000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1540]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-22T07:34:35.6020000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1541]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-22T07:34:36.0050000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[1542]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-22T07:34:37.5960000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[1543]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-22T07:34:37.5960000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000019-0000000000.json for detailed information on what checks were made. 

Event[1544]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-22T07:34:37.7170000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[1545]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-22T07:34:37.9870000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[1546]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-22T07:34:38.0190000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[1547]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-22T07:34:38.6710000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from auto start to demand start. 

Event[1548]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-22T07:34:38.7720000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[1549]
  Log Name: System
  Source: TPM
  Date: 2025-09-22T07:34:40.2010000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[1550]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-22T07:34:41.4110000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[1551]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-22T07:34:42.8560000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[1552]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-22T07:35:04.7830000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1553]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-22T07:35:11.1850000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1554]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-22T07:35:43.0210000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1555]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-22T07:35:43.0210000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1556]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-22T07:35:43.0210000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1557]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-22T07:35:43.0470000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1558]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-22T07:35:43.0470000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1559]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-22T07:35:43.0470000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1560]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-22T07:35:43.0470000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1561]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-22T07:35:43.0470000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1562]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-22T07:36:29.4680000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[1563]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-22T07:36:39.3390000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1564]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-22T07:36:39.3390000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1565]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-22T07:36:39.3390000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1566]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-22T07:37:11.3630000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[1567]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-22T07:38:39.3960000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[1568]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-22T07:39:36.0290000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[1569]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-22T07:39:36.0290000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[1570]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-22T07:41:18.6320000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1571]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-22T07:42:26.2350000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1572]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-22T07:42:26.2360000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1573]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-22T07:42:26.2380000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1574]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-22T07:42:26.2400000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1575]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-22T07:44:34.7220000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[1576]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-22T07:46:29.3130000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[1577]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-22T07:46:34.4150000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.89.0) - Current Channel (Broad) 

Event[1578]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-22T07:46:44.7510000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.89.0) - Current Channel (Broad) 

Event[1579]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-22T07:48:12.1860000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[1580]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-22T07:48:42.2820000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[1581]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-22T07:50:47.4420000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[1582]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-22T07:50:51.1460000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 0 to 1.

Reason SessionUnlock 

BootId: 19 

Event[1583]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-22T07:51:26.7950000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 1 to 3.

Reason InputHid 

BootId: 19 

Event[1584]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-22T08:02:17.7880000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1585]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-22T08:31:54.9640000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1586]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-22T08:38:54.6000000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 3 to 4.

Reason SessionUnlock 

BootId: 19 

Event[1587]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-22T08:39:06.9540000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 4 to 6.

Reason InputHid 

BootId: 19 

Event[1588]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-22T08:55:04.0940000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1589]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-22T09:09:07.9680000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 6 to 7.

Reason SessionUnlock 

BootId: 19 

Event[1590]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-22T09:09:50.7100000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 7 to 9.

Reason InputHid 

BootId: 19 

Event[1591]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-22T09:25:54.5520000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[1592]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-22T09:25:54.8750000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[1593]
  Log Name: System
  Source: EventLog
  Date: 2025-09-22T10:30:00.2110000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 10530 seconds. 

Event[1594]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-22T10:41:26.2850000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[1595]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-22T10:41:26.4390000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[1596]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-22T10:48:19.5060000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[1597]
  Log Name: System
  Source: Tcpip
  Date: 2025-09-22T10:57:10.7220000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[1598]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-22T10:58:46.3090000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[1599]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-22T11:15:50.3230000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[1600]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-22T11:32:54.3390000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[1601]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-22T11:34:22.5480000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\SystemAppData\Helium\User.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[1602]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-22T11:34:22.5520000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat was cleared updating 6 keys and creating 1 modified pages. 

Event[1603]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-22T11:35:20.2440000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name t-ring-fdv2.msedge.net timed out after none of the configured DNS servers responded. Client PID 8760. 

Event[1604]
  Log Name: System
  Source: Volsnap
  Date: 2025-09-22T11:48:08.3620000Z
  Event ID: 36
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit. 

Event[1605]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-22T11:49:58.3660000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[1606]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-22T11:52:50.2890000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume ?? (\Device\HarddiskVolumeShadowCopy3) is healthy.  No action is needed. 

Event[1607]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-22T11:52:59.9240000Z
  Event ID: 11
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy3\WINDOWS\System32\config\SYSTEM (TM: {0be02bd4-9765-11f0-a0b5-507b9da345ea}, RM: {0be02bd3-9765-11f0-a0b5-507b9da345ea}) finished with result=0xC00000A2 (Internal code=7). 

Event[1608]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-22T11:52:59.9960000Z
  Event ID: 11
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy3\WINDOWS\System32\config\DRIVERS (TM: {0be02bd7-9765-11f0-a0b5-507b9da345ea}, RM: {0be02bd6-9765-11f0-a0b5-507b9da345ea}) finished with result=0xC00000A2 (Internal code=7). 

Event[1609]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-22T11:53:00.6440000Z
  Event ID: 11
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy3\WINDOWS\System32\config\SOFTWARE (TM: {0be02bda-9765-11f0-a0b5-507b9da345ea}, RM: {0be02bd9-9765-11f0-a0b5-507b9da345ea}) finished with result=0xC00000A2 (Internal code=7). 

Event[1610]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-22T12:19:35.1330000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[1611]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-22T12:47:08.2930000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[1612]
  Log Name: System
  Source: Tcpip
  Date: 2025-09-22T13:40:09.7230000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[1613]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-22T15:07:30.4150000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.OfficePushNotificationUtility_16.0.19127.20240_neutral__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[1614]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-22T15:07:31.5520000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Office.ActionsServer_16.0.19127.20240_neutral__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[1615]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-22T15:07:31.6280000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages. 

Event[1616]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-22T15:07:32.6550000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Office.ActionsServer_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages. 

Event[1617]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-22T15:14:30.4940000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[1618]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-22T15:14:34.0840000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[1619]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-22T15:14:34.0840000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?09?-?22T11:14:34.084242000Z from ?2025?-?09?-?22T11:14:30.511256900Z.
Time Delta: 3572 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 4024).

RTC time: ?2025?-?09?-?22T16:44:34.084242000Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[1620]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-22T15:14:34.0850000Z
  Event ID: 35
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time service is now synchronizing the system time with the time source time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123) with reference id 3611644667. Current local stratum number is 4. 

Event[1621]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-22T15:14:34.0850000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[1622]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-22T15:14:34.0850000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?09?-?22T11:14:34.085417800Z from ?2025?-?09?-?22T11:14:34.085071100Z.
Time Delta: 0 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 4024).

RTC time: ?2025?-?09?-?22T16:44:34.085417800Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[1623]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-22T15:14:34.0860000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[1624]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-22T15:14:34.0870000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?09?-?22T11:14:34.086627300Z from ?2025?-?09?-?22T11:14:34.086081600Z.
Time Delta: 0 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 4024).

RTC time: ?2025?-?09?-?22T16:44:34.086627300Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[1625]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-22T15:36:11.7100000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 2 keys and creating 1 modified pages. 

Event[1626]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-22T16:18:15.3970000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[1627]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-22T16:20:06.5170000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[1628]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-22T16:20:33.5740000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 9 to 10.

Reason SessionUnlock 

BootId: 19 

Event[1629]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-22T16:21:19.1240000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[1630]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-22T16:21:19.1460000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 10 to 12.

Reason AcDcBurst 

BootId: 19 

Event[1631]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-22T16:21:24.8860000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 12 to 13.

Reason AcDcBurst 

BootId: 19 

Event[1632]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-22T16:25:40.2850000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 13 to 15.

Reason InputHid 

BootId: 19 

Event[1633]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-22T16:29:24.2150000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[1634]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-22T16:58:51.7190000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[1635]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-22T17:15:59.5090000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[1636]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-22T18:06:46.7960000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[1637]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-22T18:16:25.7980000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[1638]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-22T18:29:54.6300000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[1639]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-22T18:30:10.9720000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[1640]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-22T18:51:55.5120000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1641]
  Log Name: System
  Source: User32
  Date: 2025-09-22T18:53:57.3610000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[1642]
  Log Name: System
  Source: EventLog
  Date: 2025-09-22T18:53:59.2330000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[1643]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-22T18:53:58.5880000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[1644]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-22T18:53:59.1480000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[1645]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-22T18:53:59.2200000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[1646]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-22T18:53:59.2200000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[1647]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-22T18:53:59.2260000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[1648]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-22T18:53:59.2290000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[1649]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-22T18:53:59.2300000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[1650]
  Log Name: System
  Source: EventLog
  Date: 2025-09-23T03:53:14.6240000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[1651]
  Log Name: System
  Source: EventLog
  Date: 2025-09-23T03:53:14.6240000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[1652]
  Log Name: System
  Source: EventLog
  Date: 2025-09-23T03:53:14.6250000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[1653]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-22T18:53:59.4520000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[1654]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-22T18:53:59.4820000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[1655]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-22T18:54:00.1520000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[1656]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-22T18:54:00.1520000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[1657]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-22T18:54:01.7410000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[1658]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-22T18:54:04.0720000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[1659]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-22T18:54:04.2690000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?09?-?22T14:54:04.269848400Z. 

Event[1660]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-23T03:53:09.8900000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?09?-?22T23:53:09.500000000Z. 

Event[1661]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-23T03:53:09.8900000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?09?-?22T23:53:09.500000000Z. 

Loader time: ?2025?-?09?-?22T23:53:08.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[1662]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-23T03:53:09.8900000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[1663]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-23T03:53:09.8900000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[1664]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-23T03:53:09.8900000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[1665]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-23T03:53:09.8900000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[1666]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-23T03:53:09.8900000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[1667]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-23T03:53:09.8900000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?09?-?23T05:23:08.000000000Z. 

Event[1668]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-23T03:53:09.8900000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[1669]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-23T03:53:09.8900000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[1670]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-23T03:53:09.8940000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[1671]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-23T03:53:09.8950000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[1672]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-09-23T03:53:09.9310000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[1673]
  Log Name: System
  Source: Application Popup
  Date: 2025-09-23T03:53:10.0810000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[1674]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-23T03:53:10.2880000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1675]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-23T03:53:10.2890000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1676]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-23T03:53:10.2900000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1677]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-23T03:53:10.6890000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[1678]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-23T03:53:10.7880000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1679]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-23T03:53:10.7930000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1680]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-23T03:53:10.9250000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1681]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-23T03:53:10.9610000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[1682]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-23T03:53:10.9610000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[1683]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-23T03:53:10.9640000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[1684]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-23T03:53:11.5630000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[1685]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-23T03:53:11.6040000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1686]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-23T03:53:11.6160000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1687]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-23T03:53:11.6170000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1688]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-23T03:53:11.6240000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1689]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-23T03:53:11.6260000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[1690]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-23T03:53:11.6280000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[1691]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-23T03:53:11.6300000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1692]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-23T03:53:11.6320000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1693]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-23T03:53:11.6360000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1694]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-23T03:53:11.6390000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1695]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-23T03:53:11.6890000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[1696]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-23T03:53:11.7100000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[1697]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-23T03:53:11.7430000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[1698]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-23T03:53:12.2600000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[1699]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-23T03:53:12.3380000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[1700]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-23T03:53:13.4480000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[1701]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-23T03:53:13.4480000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[1702]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-23T03:53:13.4480000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[1703]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-23T03:53:13.4510000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[1704]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-23T03:53:13.6010000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[1705]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-23T03:53:13.6020000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[1706]
  Log Name: System
  Source: LsaSrv
  Date: 2025-09-23T03:53:13.6890000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[1707]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-23T03:53:13.9900000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[1708]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-23T03:53:14.0020000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[1709]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-23T03:53:14.0020000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[1710]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-23T03:53:14.4780000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1711]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-23T03:53:14.4890000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1712]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-23T03:53:14.5000000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1713]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-23T03:53:14.5050000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1714]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-23T03:53:14.5170000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1715]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-23T03:53:14.5330000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1716]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-23T03:53:14.5330000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[1717]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-23T03:53:14.5330000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1718]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-23T03:53:14.5420000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1719]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-23T03:53:14.5500000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1720]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-23T03:53:14.9060000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[1721]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-23T03:53:14.9060000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[1722]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-23T03:53:14.9060000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[1723]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-23T03:53:14.9310000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[1724]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-23T03:53:15.1280000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[1725]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-23T03:53:15.1600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1726]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-23T03:53:15.1600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1727]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-23T03:53:15.1600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1728]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-23T03:53:15.1600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1729]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-23T03:53:15.1600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1730]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-23T03:53:15.1600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1731]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-23T03:53:15.1600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1732]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-23T03:53:15.1600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1733]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-23T03:53:15.1600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1734]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-23T03:53:15.1600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1735]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-23T03:53:15.1600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1736]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-23T03:53:15.1600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1737]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-23T03:53:15.1600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1738]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-23T03:53:15.1600000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1739]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-23T03:53:15.6250000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[1740]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-23T03:53:17.7830000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[1741]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-23T03:53:17.9340000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[1742]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-23T03:53:18.0290000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[1743]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-23T03:53:19.2970000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[1744]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-23T03:53:19.2970000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000020-0000000000.json for detailed information on what checks were made. 

Event[1745]
  Log Name: System
  Source: TPM
  Date: 2025-09-23T03:53:20.1980000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[1746]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-23T03:53:21.2040000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\SystemAppData\Helium\User.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[1747]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-23T03:53:21.2170000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat was cleared updating 15 keys and creating 2 modified pages. 

Event[1748]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-23T03:53:21.7840000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[1749]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-23T03:53:23.6210000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[1750]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-23T03:53:29.5520000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\AppleInc.iTunes_nzyj5cx40ttqa\SystemAppData\Helium\User.dat was cleared updating 34 keys and creating 2 modified pages. 

Event[1751]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-23T03:53:29.5580000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\AppleInc.iTunes_nzyj5cx40ttqa\SystemAppData\Helium\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[1752]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-23T03:53:42.0730000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1753]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-23T03:53:58.9850000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1754]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-23T03:54:22.7600000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1755]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-23T03:54:22.7760000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1756]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-23T03:54:22.7760000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1757]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-23T03:54:22.7920000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1758]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-23T03:54:22.7920000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1759]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-23T03:54:22.7920000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1760]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-23T03:54:22.7920000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1761]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-23T03:54:22.7920000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1762]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-23T03:54:27.5270000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1763]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-23T03:54:27.5290000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1764]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-23T03:54:27.5310000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1765]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-23T03:54:27.5310000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1766]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-23T03:55:14.8060000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1767]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-23T03:55:23.7490000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1768]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-23T03:55:23.7500000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1769]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-23T03:55:55.3730000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[1770]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-23T03:57:22.2710000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[1771]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-23T03:58:15.0990000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[1772]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-23T03:58:15.0990000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[1773]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-23T03:59:25.6560000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[1774]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-23T04:01:59.3600000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[1775]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-23T04:03:36.9100000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[1776]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-23T04:04:01.0190000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.105.0) - Current Channel (Broad) 

Event[1777]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-23T04:04:11.8690000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.105.0) - Current Channel (Broad) 

Event[1778]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-23T04:08:57.1990000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container MicrosoftWindows.Client.WebExperience_525.24401.50.0_x64__cw5n1h2txyewy SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1779]
  Log Name: System
  Source: Tcpip
  Date: 2025-09-23T04:48:10.2260000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[1780]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-23T04:59:27.1910000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[1781]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-23T04:59:57.5580000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[1782]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-23T04:59:57.7050000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[1783]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-23T04:59:57.9760000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from demand start to auto start. 

Event[1784]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-23T05:00:08.3810000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from auto start to demand start. 

Event[1785]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-23T05:00:10.6500000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from demand start to auto start. 

Event[1786]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-23T05:00:10.7270000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from auto start to demand start. 

Event[1787]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-23T05:00:17.6600000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from demand start to auto start. 

Event[1788]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-23T05:03:35.3270000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from auto start to demand start. 

Event[1789]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-23T05:17:17.6030000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[1790]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-23T05:34:21.6240000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[1791]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-23T05:51:25.6470000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[1792]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-23T06:08:29.6710000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[1793]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-23T08:09:26.8020000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1794]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-23T08:18:19.4230000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1795]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-23T08:50:45.3490000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[1796]
  Log Name: System
  Source: Tcpip
  Date: 2025-09-23T09:27:01.2330000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[1797]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-23T09:33:01.7450000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[1798]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-23T09:33:01.7490000Z
  Event ID: 35
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time service is now synchronizing the system time with the time source time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123) with reference id 3611644667. Current local stratum number is 4. 

Event[1799]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-23T09:33:01.7500000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[1800]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-23T09:33:01.7500000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?09?-?23T05:33:01.750211500Z from ?2025?-?09?-?23T05:33:01.749429800Z.
Time Delta: 0 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 6680).

RTC time: ?2025?-?09?-?23T11:03:01.750211500Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[1801]
  Log Name: System
  Source: EventLog
  Date: 2025-09-23T10:30:00.7520000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 23811 seconds. 

Event[1802]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-23T11:32:10.4610000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[1803]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-23T14:34:17.3690000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[1804]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-23T14:34:20.0080000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\1a714a01dc9b411f_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[1805]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-23T14:57:19.5150000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[1806]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-23T14:58:50.5740000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxGamingOverlay_7.325.9112.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[1807]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-23T14:58:51.5190000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: 9NZKPSTSNW4P-Microsoft.XboxGamingOverlay 

Event[1808]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-23T14:58:51.8620000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 5 keys and creating 1 modified pages. 

Event[1809]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-23T14:58:52.5260000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: 9NZKPSTSNW4P-Microsoft.XboxGamingOverlay 

Event[1810]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-23T15:36:26.4560000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat was cleared updating 2 keys and creating 1 modified pages. 

Event[1811]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-23T15:36:37.5250000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[1812]
  Log Name: System
  Source: Tcpip
  Date: 2025-09-23T15:40:54.2220000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[1813]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-23T15:51:32.3060000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[1814]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-23T15:53:37.1300000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[1815]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-23T15:58:15.1190000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[1816]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-23T15:58:15.1190000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[1817]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-23T16:24:18.6720000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[1818]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-23T16:27:20.1000000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[1819]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-23T16:29:34.7030000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[1820]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-23T16:29:48.4950000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.112.0) - Current Channel (Broad) 

Event[1821]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-23T16:30:03.3320000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.112.0) - Current Channel (Broad) 

Event[1822]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-23T16:31:05.4540000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[1823]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-23T16:33:09.7130000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[1824]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-23T18:00:02.1560000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[1825]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-24T03:54:22.7630000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86400 seconds since the last report. 

Event[1826]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-24T03:54:22.7780000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86400 seconds since the last report. 

Event[1827]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-24T03:54:22.7780000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86400 seconds since the last report. 

Event[1828]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-24T03:54:22.7950000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86400 seconds since the last report. 

Event[1829]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-24T03:54:22.7950000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86400 seconds since the last report. 

Event[1830]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-24T03:54:22.7950000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86400 seconds since the last report. 

Event[1831]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-24T03:54:22.7950000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86400 seconds since the last report. 

Event[1832]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-24T03:54:22.7950000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86400 seconds since the last report. 

Event[1833]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-24T03:58:15.1550000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[1834]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-24T03:58:15.1550000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[1835]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-24T07:07:16.1820000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[1836]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-24T07:07:30.5850000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[1837]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-24T07:08:46.2630000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[1838]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-24T07:09:19.9380000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.126.0) - Current Channel (Broad) 

Event[1839]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-24T07:09:30.7260000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.126.0) - Current Channel (Broad) 

Event[1840]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-24T07:12:39.0500000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[1841]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-24T07:12:39.9730000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[1842]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-24T07:34:56.4580000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[1843]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-24T07:52:22.5150000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[1844]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-24T07:52:22.6540000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[1845]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-24T08:09:42.5410000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[1846]
  Log Name: System
  Source: Tcpip
  Date: 2025-09-24T08:14:00.7270000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[1847]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-24T08:26:46.5650000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[1848]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-24T08:43:50.5850000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[1849]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-24T09:00:54.6090000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[1850]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-24T09:14:41.2790000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[1851]
  Log Name: System
  Source: EventLog
  Date: 2025-09-24T10:30:00.7650000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 110211 seconds. 

Event[1852]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-24T10:36:44.7050000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[1853]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-24T10:43:52.2310000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[1854]
  Log Name: System
  Source: Tcpip
  Date: 2025-09-24T11:30:30.2300000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[1855]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-24T12:25:26.7540000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[1856]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-24T12:25:26.7590000Z
  Event ID: 35
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time service is now synchronizing the system time with the time source time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123) with reference id 3611644667. Current local stratum number is 4. 

Event[1857]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-24T12:25:26.7600000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[1858]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-24T12:25:26.7600000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?09?-?24T08:25:26.760155700Z from ?2025?-?09?-?24T08:25:26.759974800Z.
Time Delta: 0 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 12684).

RTC time: ?2025?-?09?-?24T13:55:26.760155700Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[1859]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-24T12:32:46.6670000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[1860]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-24T15:55:56.7570000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[1861]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-24T15:58:01.2080000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[1862]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-24T15:58:15.2010000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[1863]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-24T15:58:15.2010000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[1864]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-24T16:28:51.5810000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[1865]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-24T16:29:22.4010000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[1866]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-24T16:35:16.8280000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.YourPhone_1.25082.142.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[1867]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-24T16:35:18.3070000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: 9NMPJ99VJBWV-Microsoft.YourPhone 

Event[1868]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-24T16:35:18.6650000Z
  Event ID: 20
  Task: Windows Update Agent 
  Level: Error 
  Opcode: Installation  
  Keyword: Installation,Failure, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Failure: Windows failed to install the following update with error 0x80073D02: 9NMPJ99VJBWV-Microsoft.YourPhone. 

Event[1869]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-24T17:08:35.2520000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\e59fd33af7a9be35_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[1870]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-24T17:08:35.4430000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\DropboxInc.Dropbox_wkt425jdc3sga\SystemAppData\Helium\User.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[1871]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-24T17:08:35.4480000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\DropboxInc.Dropbox_wkt425jdc3sga\SystemAppData\Helium\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[1872]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-24T17:08:35.4530000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\DropboxInc.Dropbox_wkt425jdc3sga\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\4bd81bf37a78b2d8_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[1873]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-24T17:26:17.8070000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[1874]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-24T17:28:24.2150000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[1875]
  Log Name: System
  Source: Tcpip
  Date: 2025-09-24T17:31:13.2310000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[1876]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-24T17:32:36.8070000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[1877]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-24T17:33:17.3070000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[1878]
  Log Name: System
  Source: User32
  Date: 2025-09-24T20:10:44.4970000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[1879]
  Log Name: System
  Source: EventLog
  Date: 2025-09-24T20:10:51.0730000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[1880]
  Log Name: System
  Source: winsrvext
  Date: 2025-09-24T20:10:50.1160000Z
  Event ID: 100
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Process C:\Windows\explorer.exe is delaying system shutdown after 5031 milliseconds. 

Event[1881]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-24T20:10:50.4860000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[1882]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-24T20:10:51.0120000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[1883]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-24T20:10:51.0660000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[1884]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-24T20:10:51.0660000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[1885]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-24T20:10:51.0690000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[1886]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-24T20:10:51.0760000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[1887]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-24T20:10:51.0760000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[1888]
  Log Name: System
  Source: EventLog
  Date: 2025-09-25T08:06:37.1660000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[1889]
  Log Name: System
  Source: EventLog
  Date: 2025-09-25T08:06:37.1670000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[1890]
  Log Name: System
  Source: EventLog
  Date: 2025-09-25T08:06:37.1670000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[1891]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-24T20:10:51.3120000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[1892]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-24T20:10:51.3500000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[1893]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-24T20:10:51.6980000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[1894]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-24T20:10:52.0270000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[1895]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-24T20:10:52.0270000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[1896]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-24T20:10:54.3520000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[1897]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-24T20:10:54.5080000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?09?-?24T16:10:54.508124600Z. 

Event[1898]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-25T08:06:31.9060000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?09?-?25T04:06:31.500000000Z. 

Event[1899]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-25T08:06:31.9060000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?09?-?25T04:06:31.500000000Z. 

Loader time: ?2025?-?09?-?25T04:06:30.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[1900]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-25T08:06:31.9060000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[1901]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-25T08:06:31.9060000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[1902]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-25T08:06:31.9060000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[1903]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-25T08:06:31.9060000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[1904]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-25T08:06:31.9060000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[1905]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-25T08:06:31.9060000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?09?-?25T09:36:30.000000000Z. 

Event[1906]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-25T08:06:31.9060000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[1907]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-25T08:06:31.9060000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[1908]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-25T08:06:31.9100000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[1909]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-25T08:06:31.9100000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[1910]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-09-25T08:06:31.9450000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[1911]
  Log Name: System
  Source: Application Popup
  Date: 2025-09-25T08:06:32.0950000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[1912]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-25T08:06:32.3320000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1913]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-25T08:06:32.3330000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1914]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-25T08:06:32.3340000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1915]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-25T08:06:32.8710000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[1916]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-25T08:06:32.9700000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1917]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-25T08:06:32.9760000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1918]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-25T08:06:33.1160000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1919]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-25T08:06:33.1550000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[1920]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-25T08:06:33.1550000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[1921]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-25T08:06:33.1570000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[1922]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-25T08:06:33.7660000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[1923]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-25T08:06:33.8090000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1924]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-25T08:06:33.8190000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1925]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-25T08:06:33.8290000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[1926]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-25T08:06:33.8290000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[1927]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-25T08:06:33.8320000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1928]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-25T08:06:33.8330000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1929]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-25T08:06:33.8350000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1930]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-25T08:06:33.8380000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1931]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-25T08:06:33.8400000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1932]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-25T08:06:33.9040000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[1933]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-25T08:06:33.9080000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[1934]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-25T08:06:33.9750000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[1935]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-25T08:06:34.4300000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[1936]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-25T08:06:34.6360000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[1937]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-25T08:06:34.7090000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[1938]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-25T08:06:35.5750000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[1939]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-25T08:06:35.5750000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[1940]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-25T08:06:35.5750000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[1941]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-25T08:06:35.5780000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[1942]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-25T08:06:35.7680000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[1943]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-25T08:06:35.7690000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[1944]
  Log Name: System
  Source: LsaSrv
  Date: 2025-09-25T08:06:35.8400000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[1945]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-25T08:06:36.0370000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[1946]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-25T08:06:36.0490000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[1947]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-25T08:06:36.0490000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[1948]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-25T08:06:37.0020000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1949]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-25T08:06:37.0120000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1950]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-25T08:06:37.0230000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1951]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-25T08:06:37.0380000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1952]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-25T08:06:37.0570000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1953]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-25T08:06:37.0570000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[1954]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-25T08:06:37.0570000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1955]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-25T08:06:37.0620000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1956]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-25T08:06:37.0690000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1957]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-25T08:06:37.0760000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1958]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-25T08:06:37.4300000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[1959]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-25T08:06:37.4300000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[1960]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-25T08:06:37.4300000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[1961]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-25T08:06:37.4640000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[1962]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-25T08:06:37.6400000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[1963]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-25T08:06:37.6570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1964]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-25T08:06:37.6570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1965]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-25T08:06:37.6570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1966]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-25T08:06:37.6570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1967]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-25T08:06:37.6570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1968]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-25T08:06:37.6570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1969]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-25T08:06:37.6570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1970]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-25T08:06:37.6570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1971]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-25T08:06:37.6570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1972]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-25T08:06:37.6570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1973]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-25T08:06:37.6570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1974]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-25T08:06:37.6570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1975]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-25T08:06:37.6570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1976]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-25T08:06:37.6570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[1977]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-25T08:06:38.0480000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[1978]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-25T08:06:39.4130000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[1979]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-25T08:06:39.4130000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000021-0000000000.json for detailed information on what checks were made. 

Event[1980]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-25T08:06:39.9270000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[1981]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-25T08:06:40.0460000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[1982]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-25T08:06:40.0770000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[1983]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-25T08:06:41.1490000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\c93b3c73e758942_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[1984]
  Log Name: System
  Source: TPM
  Date: 2025-09-25T08:06:42.2230000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[1985]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-25T08:06:43.1120000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[1986]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-25T08:06:43.5240000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\26fe02ce68e5babf_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[1987]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-25T08:06:43.8380000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\81d060ca2aba6fa4_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[1988]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-25T08:06:44.1920000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[1989]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-25T08:06:46.2180000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 42 keys and creating 4 modified pages. 

Event[1990]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-25T08:06:51.9130000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\AppleInc.iTunes_nzyj5cx40ttqa\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\28734fb83f5b5911_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[1991]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-25T08:07:01.5440000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[1992]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-25T08:07:35.4960000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[1993]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-25T08:07:44.9760000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1994]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-25T08:07:44.9760000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1995]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-25T08:07:44.9920000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1996]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-25T08:07:44.9920000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1997]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-25T08:07:45.0080000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1998]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-25T08:07:45.0080000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[1999]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-25T08:07:45.0080000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2000]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-25T08:07:45.0080000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2001]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-25T08:08:41.5690000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2002]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-25T08:08:41.5690000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2003]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-25T08:08:41.5690000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2004]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-25T08:09:14.0980000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[2005]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-25T08:11:37.7450000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[2006]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-25T08:11:37.7450000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[2007]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-25T08:11:42.7800000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2008]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-25T08:15:11.6900000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name ec.sheetedunrope.com timed out after none of the configured DNS servers responded. Client PID 9744. 

Event[2009]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-25T08:16:08.3410000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2010]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-25T08:16:08.3430000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2011]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-25T08:16:08.3460000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2012]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-25T08:16:08.3480000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2013]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-25T08:17:18.1990000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[2014]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-25T08:17:40.1110000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.129.0) - Current Channel (Broad) 

Event[2015]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-25T08:17:50.4350000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.129.0) - Current Channel (Broad) 

Event[2016]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-25T08:19:41.5130000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[2017]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-25T08:20:47.3990000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2018]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-25T08:20:47.5420000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[2019]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-25T08:21:57.7530000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[2020]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-25T08:22:05.8220000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[2021]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-25T08:22:30.0870000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\Helium\User.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[2022]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-25T08:23:25.6460000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.147.0) - Current Channel (Broad) 

Event[2023]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-25T08:23:36.8510000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.147.0) - Current Channel (Broad) 

Event[2024]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-25T08:24:01.9620000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[2025]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-25T08:25:13.4210000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name img.cdno.my.id timed out after none of the configured DNS servers responded. Client PID 9744. 

Event[2026]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-25T08:25:47.8840000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name img.cdno.my.id timed out after none of the configured DNS servers responded. Client PID 9744. 

Event[2027]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-25T08:26:47.5910000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name zy.oasalgiro.com timed out after none of the configured DNS servers responded. Client PID 9744. 

Event[2028]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-25T08:33:08.7110000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name zy.oasalgiro.com timed out after none of the configured DNS servers responded. Client PID 9744. 

Event[2029]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-25T08:35:24.8880000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name yesgwyn.com timed out after none of the configured DNS servers responded. Client PID 9744. 

Event[2030]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-25T08:38:07.4350000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2031]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-25T08:55:11.4540000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2032]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-25T08:56:10.9030000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[2033]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-25T08:59:46.3640000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[2034]
  Log Name: System
  Source: BTHUSB
  Date: 2025-09-25T09:02:58.7960000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[2035]
  Log Name: System
  Source: BTHUSB
  Date: 2025-09-25T09:02:58.8560000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[2036]
  Log Name: System
  Source: Tcpip
  Date: 2025-09-25T09:02:59.7120000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[2037]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-25T09:03:00.4290000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name t-ring-fdv2.msedge.net timed out after none of the configured DNS servers responded. Client PID 7392. 

Event[2038]
  Log Name: System
  Source: BTHUSB
  Date: 2025-09-25T09:03:41.2650000Z
  Event ID: 8
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The remote adapter (74:45:ce:ff:fc:cf) successfully paired with the local adapter. 

Event[2039]
  Log Name: System
  Source: Microsoft-Windows-DeviceAssociationService
  Date: 2025-09-25T09:03:41.2700000Z
  Event ID: 2500
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Device Association (Pairing) Succeeded. 

Event[2040]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-25T09:03:41.9420000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  Microsoft Bluetooth Hands-Free Audio driver
Service File Name:  \SystemRoot\System32\drivers\BthHfAud.sys
Service Type:  kernel mode driver
Service Start Type:  demand start
Service Account:   

Event[2041]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-25T09:12:15.4680000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2042]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-25T09:29:19.4800000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2043]
  Log Name: System
  Source: EventLog
  Date: 2025-09-25T10:30:00.1750000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 8608 seconds. 

Event[2044]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-25T11:41:41.8310000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[2045]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-25T12:53:54.0000000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[2046]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-25T12:54:09.8080000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[2047]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-25T12:54:09.8080000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?09?-?25T08:54:09.807912300Z from ?2025?-?09?-?25T08:54:07.684975600Z.
Time Delta: 2122 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 1272).

RTC time: ?2025?-?09?-?25T14:24:09.807912300Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[2048]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-25T12:54:09.8080000Z
  Event ID: 35
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time service is now synchronizing the system time with the time source time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->40.81.94.65:123) with reference id 1096700200. Current local stratum number is 4. 

Event[2049]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-25T12:54:09.8090000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[2050]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-25T12:54:09.8090000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?09?-?25T08:54:09.808850800Z from ?2025?-?09?-?25T08:54:09.807912300Z.
Time Delta: 0 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 1272).

RTC time: ?2025?-?09?-?25T14:24:09.808850800Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[2051]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-25T12:54:09.8100000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[2052]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-25T12:54:09.8100000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?09?-?25T08:54:09.810169900Z from ?2025?-?09?-?25T08:54:09.810042500Z.
Time Delta: 0 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 1272).

RTC time: ?2025?-?09?-?25T14:24:09.810169900Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[2053]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-25T14:02:33.1300000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[2054]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-25T14:04:49.4690000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[2055]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-25T14:43:50.4760000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2056]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-25T14:43:50.9490000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Intel(R) Content Protection HECI Service service terminated with the following error: 
Unspecified error 

Event[2057]
  Log Name: System
  Source: Tcpip
  Date: 2025-09-25T15:21:34.3420000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[2058]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-25T16:17:29.3050000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[2059]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-25T16:31:18.4900000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container MicrosoftWindows.Client.WebExperience_525.24401.50.0_x64__cw5n1h2txyewy SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2060]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-25T17:21:41.6560000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[2061]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-25T17:22:42.7810000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: 9MVZQVXJBQ9V-Microsoft.AV1VideoExtension 

Event[2062]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-25T17:22:42.9090000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume ?? (\Device\HarddiskVolumeShadowCopy2) is healthy.  No action is needed. 

Event[2063]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-25T17:22:43.1190000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.AV1VideoExtension_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[2064]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-25T17:22:44.1770000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: 9MVZQVXJBQ9V-Microsoft.AV1VideoExtension 

Event[2065]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-25T17:23:01.8560000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[2066]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-25T17:25:06.0990000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[2067]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-25T18:01:31.2400000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[2068]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-25T18:03:37.4390000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[2069]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-25T18:06:49.6500000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[2070]
  Log Name: System
  Source: User32
  Date: 2025-09-25T18:42:31.7630000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[2071]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-25T18:42:32.5560000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[2072]
  Log Name: System
  Source: EventLog
  Date: 2025-09-25T18:42:33.1440000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[2073]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-25T18:42:33.0810000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[2074]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-25T18:42:33.1420000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[2075]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-25T18:42:33.1420000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[2076]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-25T18:42:33.1440000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[2077]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-25T18:42:33.1450000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[2078]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-25T18:42:33.1540000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[2079]
  Log Name: System
  Source: EventLog
  Date: 2025-09-28T09:13:12.2740000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[2080]
  Log Name: System
  Source: EventLog
  Date: 2025-09-28T09:13:12.2740000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[2081]
  Log Name: System
  Source: EventLog
  Date: 2025-09-28T09:13:12.2750000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[2082]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-25T18:42:33.3370000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[2083]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-25T18:42:33.3540000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[2084]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-25T18:42:33.9580000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[2085]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-25T18:42:34.0830000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[2086]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-25T18:42:34.0830000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[2087]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-25T18:42:36.4610000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[2088]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-25T18:42:36.8270000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?09?-?25T14:42:36.827124100Z. 

Event[2089]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-28T09:13:06.8980000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?09?-?28T05:13:06.500000000Z. 

Event[2090]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-28T09:13:06.8980000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?09?-?28T05:13:06.500000000Z. 

Loader time: ?2025?-?09?-?28T05:13:05.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[2091]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-28T09:13:06.8990000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[2092]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-28T09:13:06.8990000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[2093]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-28T09:13:06.8990000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[2094]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-28T09:13:06.8990000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[2095]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-28T09:13:06.8990000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[2096]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-28T09:13:06.8990000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?09?-?28T10:43:05.000000000Z. 

Event[2097]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-28T09:13:06.8990000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[2098]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-28T09:13:06.8990000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[2099]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-28T09:13:06.9030000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[2100]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-28T09:13:06.9030000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[2101]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-09-28T09:13:06.9440000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[2102]
  Log Name: System
  Source: Application Popup
  Date: 2025-09-28T09:13:07.0930000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[2103]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-28T09:13:07.3050000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2104]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-28T09:13:07.3060000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2105]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-28T09:13:07.3080000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2106]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-28T09:13:07.7150000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[2107]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-28T09:13:07.8400000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2108]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-28T09:13:07.8450000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2109]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-28T09:13:07.9910000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2110]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-28T09:13:08.0320000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[2111]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-28T09:13:08.0320000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[2112]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-28T09:13:08.0340000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[2113]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-28T09:13:08.6620000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[2114]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-28T09:13:08.7020000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2115]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-28T09:13:08.7110000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2116]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-28T09:13:08.7130000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2117]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-28T09:13:08.7140000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2118]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-28T09:13:08.7230000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[2119]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-28T09:13:08.7230000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[2120]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-28T09:13:08.7320000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2121]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-28T09:13:08.7330000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2122]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-28T09:13:08.7350000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2123]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-28T09:13:08.7860000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2124]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-28T09:13:08.7900000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[2125]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-28T09:13:08.8570000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[2126]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-28T09:13:09.4220000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[2127]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-28T09:13:09.6250000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[2128]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-28T09:13:09.7180000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[2129]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-28T09:13:10.6740000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[2130]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-28T09:13:10.6740000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[2131]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-28T09:13:10.6740000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[2132]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-28T09:13:10.6760000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[2133]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-28T09:13:10.8600000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[2134]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-28T09:13:10.8620000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[2135]
  Log Name: System
  Source: LsaSrv
  Date: 2025-09-28T09:13:10.9160000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[2136]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-28T09:13:11.1270000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[2137]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-28T09:13:11.1400000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[2138]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-28T09:13:11.1400000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[2139]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-28T09:13:12.1200000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2140]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-28T09:13:12.1300000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2141]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-28T09:13:12.1370000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2142]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-28T09:13:12.1490000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2143]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-28T09:13:12.1700000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2144]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-28T09:13:12.1700000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[2145]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-28T09:13:12.1710000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2146]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-28T09:13:12.1760000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2147]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-28T09:13:12.1830000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2148]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-28T09:13:12.1910000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2149]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-28T09:13:12.5000000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[2150]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-28T09:13:12.5000000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[2151]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-28T09:13:12.5000000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[2152]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-28T09:13:12.5560000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[2153]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-28T09:13:12.7570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2154]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-28T09:13:12.7570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2155]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-28T09:13:12.7570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2156]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-28T09:13:12.7570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2157]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-28T09:13:12.7570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2158]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-28T09:13:12.7570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2159]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-28T09:13:12.7570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2160]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-28T09:13:12.7570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2161]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-28T09:13:12.7570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2162]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-28T09:13:12.7570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2163]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-28T09:13:12.7570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2164]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-28T09:13:12.7570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2165]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-28T09:13:12.7570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2166]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-28T09:13:12.7580000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2167]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-28T09:13:12.7620000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[2168]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-28T09:13:13.1340000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[2169]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-28T09:13:14.8970000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[2170]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-28T09:13:14.8970000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000022-0000000000.json for detailed information on what checks were made. 

Event[2171]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-28T09:13:15.3390000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[2172]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-28T09:13:15.4760000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[2173]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-28T09:13:15.5210000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[2174]
  Log Name: System
  Source: TPM
  Date: 2025-09-28T09:13:17.2200000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[2175]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-28T09:13:18.8970000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[2176]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-28T09:13:19.9340000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[2177]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-28T09:13:20.1380000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[2178]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-28T09:13:37.0580000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2179]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-28T09:13:47.5870000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2180]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-28T09:14:19.8660000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2181]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-28T09:14:19.8660000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2182]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-28T09:14:19.8660000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2183]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-28T09:14:19.8660000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2184]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-28T09:14:19.8960000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2185]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-28T09:14:19.8960000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2186]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-28T09:14:19.8960000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2187]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-28T09:14:19.8960000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2188]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-28T09:15:16.8010000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2189]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-28T09:15:16.8010000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2190]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-28T09:15:54.9080000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[2191]
  Log Name: System
  Source: Microsoft-Windows-Configuration-Change-Monitor
  Date: 2025-09-28T09:16:14.8630000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
N/A

Event[2192]
  Log Name: System
  Source: Microsoft-Windows-Configuration-Change-Monitor
  Date: 2025-09-28T09:16:15.0130000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
N/A

Event[2193]
  Log Name: System
  Source: Microsoft-Windows-Configuration-Change-Monitor
  Date: 2025-09-28T09:16:15.0950000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
N/A

Event[2194]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-28T09:16:17.0580000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (Version 6.1, ?2019?-?02?-?11T22:09:19.000000000Z) unloaded successfully. 

Event[2195]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-28T09:16:20.6540000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\DropboxInc.Dropbox_wkt425jdc3sga\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages. 

Event[2196]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-28T09:16:35.6880000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[2197]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-28T09:16:37.1490000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2198]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-28T09:16:39.6760000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[2199]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-28T09:16:42.0250000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2200]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-28T09:16:48.5300000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\93bd85b35cc104b1_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[2201]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-28T09:17:41.1300000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2202]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-28T09:17:41.1300000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2203]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-28T09:17:41.1360000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2204]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-28T09:17:41.1380000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2205]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-28T09:18:12.8450000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[2206]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-28T09:18:12.8450000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[2207]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-28T09:18:13.4000000Z
  Event ID: 7024
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The DropboxUpdater Service 123.0.6299.129 (DropboxUpdaterService123.0.6299.129) service terminated with the following service-specific error: 
%%45 

Event[2208]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-28T09:18:20.6930000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[2209]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-28T09:18:43.3560000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[2210]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-28T09:20:26.7880000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[2211]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-28T09:20:51.6210000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2212]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-28T09:25:15.4820000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[2213]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-28T09:25:30.0750000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.OfficePushNotificationUtility_16.0.19127.20264_neutral__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[2214]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-28T09:25:31.0960000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Office.ActionsServer_16.0.19127.20264_neutral__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[2215]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-28T09:26:25.5420000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.193.0) - Current Channel (Broad) 

Event[2216]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-28T09:26:39.5560000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.193.0) - Current Channel (Broad) 

Event[2217]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-28T09:28:42.8240000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[2218]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-28T09:28:42.8240000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[2219]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-28T09:30:52.6080000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[2220]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-28T09:31:30.1160000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsStore_22508.1401.4.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[2221]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-28T09:31:31.2880000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: 9WZDNCRFJBMP-MICROSOFT.WINDOWSSTORE 

Event[2222]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-28T09:31:32.2970000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: 9WZDNCRFJBMP-MICROSOFT.WINDOWSSTORE 

Event[2223]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-28T09:32:57.6160000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.CrossDevice_1.25082.81.0_x64__cw5n1h2txyewy\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[2224]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-28T09:32:58.5230000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: 9NTXGKQ8P7N0-MicrosoftWindows.CrossDevice 

Event[2225]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-28T09:32:58.7930000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\MicrosoftWindows.CrossDevice_cw5n1h2txyewy\Settings\settings.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[2226]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-28T09:32:59.3370000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: 9NTXGKQ8P7N0-MicrosoftWindows.CrossDevice 

Event[2227]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-28T09:36:54.0930000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2228]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-28T09:36:54.3470000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[2229]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-28T09:38:28.4050000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[2230]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-28T09:38:55.4690000Z
  Event ID: 11
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\WINDOWS\System32\config\SYSTEM (TM: {d1291d45-9c29-11f0-a0b8-507b9da345ea}, RM: {d1291d44-9c29-11f0-a0b8-507b9da345ea}) finished with result=0xC00000A2 (Internal code=7). 

Event[2231]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-28T09:38:55.5400000Z
  Event ID: 11
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\WINDOWS\System32\config\DRIVERS (TM: {d1291d48-9c29-11f0-a0b8-507b9da345ea}, RM: {d1291d47-9c29-11f0-a0b8-507b9da345ea}) finished with result=0xC00000A2 (Internal code=7). 

Event[2232]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-28T09:38:56.5000000Z
  Event ID: 11
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\WINDOWS\System32\config\SOFTWARE (TM: {d1291d4b-9c29-11f0-a0b8-507b9da345ea}, RM: {d1291d4a-9c29-11f0-a0b8-507b9da345ea}) finished with result=0xC00000A2 (Internal code=7). 

Event[2233]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-28T09:40:32.6180000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[2234]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-28T09:54:14.1260000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2235]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-28T10:11:18.1270000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2236]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-28T10:14:21.3120000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[2237]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-28T10:28:22.1360000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2238]
  Log Name: System
  Source: EventLog
  Date: 2025-09-28T10:30:00.2780000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 4613 seconds. 

Event[2239]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-28T10:45:26.1430000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2240]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-28T11:16:30.8730000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[2241]
  Log Name: System
  Source: Tcpip
  Date: 2025-09-28T12:06:02.2220000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[2242]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-28T13:04:10.6350000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[2243]
  Log Name: System
  Source: BTHUSB
  Date: 2025-09-28T13:44:39.4360000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[2244]
  Log Name: System
  Source: BTHUSB
  Date: 2025-09-28T13:44:39.4730000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[2245]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-28T14:09:58.2270000Z
  Event ID: 134
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on 'time.windows.com,0x9'. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: No such host is known. (0x80072AF9) 

Event[2246]
  Log Name: System
  Source: User32
  Date: 2025-09-28T14:41:37.0820000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[2247]
  Log Name: System
  Source: EventLog
  Date: 2025-09-28T14:41:38.5260000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[2248]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-28T14:41:38.1240000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[2249]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-28T14:41:38.4600000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[2250]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-28T14:41:38.5170000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[2251]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-28T14:41:38.5170000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[2252]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-28T14:41:38.5190000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[2253]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-28T14:41:38.5200000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[2254]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-28T14:41:38.5270000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[2255]
  Log Name: System
  Source: EventLog
  Date: 2025-09-29T06:54:42.4070000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[2256]
  Log Name: System
  Source: EventLog
  Date: 2025-09-29T06:54:42.4070000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[2257]
  Log Name: System
  Source: EventLog
  Date: 2025-09-29T06:54:42.4080000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 8 seconds. 

Event[2258]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-28T14:41:38.7180000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[2259]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-28T14:41:38.7420000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[2260]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-28T14:41:39.2060000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[2261]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-28T14:41:39.4740000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[2262]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-28T14:41:39.4740000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[2263]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-28T14:41:39.7590000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[2264]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-28T14:41:39.9390000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?09?-?28T10:41:39.939372900Z. 

Event[2265]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:34.1890000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?09?-?29T02:54:33.500000000Z. 

Event[2266]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:34.1890000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?09?-?29T02:54:33.500000000Z. 

Loader time: ?2025?-?09?-?29T02:54:32.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[2267]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-29T06:54:34.1890000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[2268]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-29T06:54:34.1890000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[2269]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-29T06:54:34.1890000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[2270]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-29T06:54:34.1890000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[2271]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-29T06:54:34.1890000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[2272]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-29T06:54:34.1890000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?09?-?29T08:24:32.000000000Z. 

Event[2273]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-29T06:54:34.1890000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[2274]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-29T06:54:34.1890000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[2275]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-29T06:54:34.1920000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[2276]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:34.1920000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[2277]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-09-29T06:54:34.2180000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[2278]
  Log Name: System
  Source: Application Popup
  Date: 2025-09-29T06:54:34.3590000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[2279]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-29T06:54:34.5700000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2280]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-29T06:54:34.5710000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2281]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-29T06:54:34.5720000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2282]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-29T06:54:35.0720000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[2283]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-29T06:54:35.2350000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2284]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-29T06:54:35.2400000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2285]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-29T06:54:35.4180000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2286]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-29T06:54:35.4670000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[2287]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-29T06:54:35.4670000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[2288]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-29T06:54:35.4690000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[2289]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:35.4790000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \SystemRoot\System32\Config\SAM was cleared updating 58 keys and creating 6 modified pages. 

Event[2290]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:35.4800000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \SystemRoot\System32\Config\SECURITY was cleared updating 92 keys and creating 4 modified pages. 

Event[2291]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:35.4900000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \SystemRoot\System32\Config\DEFAULT was cleared updating 1095 keys and creating 134 modified pages. 

Event[2292]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-29T06:54:36.3490000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[2293]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-29T06:54:36.3910000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2294]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-29T06:54:36.4000000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2295]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-29T06:54:36.4010000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2296]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-29T06:54:36.4140000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[2297]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-29T06:54:36.4140000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[2298]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-29T06:54:36.4180000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2299]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-29T06:54:36.4250000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2300]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-29T06:54:36.4260000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2301]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-29T06:54:36.4280000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2302]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-29T06:54:36.4900000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2303]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-29T06:54:36.4940000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[2304]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-29T06:54:36.5620000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[2305]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:36.6490000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \Device\HarddiskVolume1\EFI\Microsoft\Boot\BCD was cleared updating 73 keys and creating 6 modified pages. 

Event[2306]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-29T06:54:37.2480000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[2307]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:37.4010000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \Device\HarddiskVolume1\EFI\Microsoft\Boot\BCD was cleared updating 73 keys and creating 6 modified pages. 

Event[2308]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:37.4540000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \Device\HarddiskVolume1\EFI\Microsoft\Boot\BCD was cleared updating 73 keys and creating 6 modified pages. 

Event[2309]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-29T06:54:37.4750000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[2310]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:37.4960000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \Device\HarddiskVolume1\EFI\Microsoft\Boot\BCD was cleared updating 73 keys and creating 6 modified pages. 

Event[2311]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:37.4990000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \Device\HarddiskVolume1\EFI\Microsoft\Boot\BCD was cleared updating 73 keys and creating 6 modified pages. 

Event[2312]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:37.5020000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \Device\HarddiskVolume1\EFI\Microsoft\Boot\BCD was cleared updating 73 keys and creating 6 modified pages. 

Event[2313]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:38.7120000Z
  Event ID: 15
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Hive \SystemRoot\System32\Config\SOFTWARE was reorganized with a starting size of 118894592 bytes and an ending size of 110592000 bytes. 

Event[2314]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:38.7410000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[2315]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:38.7500000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \Device\HarddiskVolume1\EFI\Microsoft\Boot\BCD was cleared updating 73 keys and creating 6 modified pages. 

Event[2316]
  Log Name: System
  Source: BTHUSB
  Date: 2025-09-29T06:54:39.4080000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[2317]
  Log Name: System
  Source: BTHUSB
  Date: 2025-09-29T06:54:39.4820000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[2318]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-29T06:54:40.8700000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[2319]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-29T06:54:40.8700000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[2320]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-29T06:54:40.8700000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[2321]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-29T06:54:40.8710000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[2322]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-29T06:54:40.9730000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[2323]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-29T06:54:40.9740000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[2324]
  Log Name: System
  Source: LsaSrv
  Date: 2025-09-29T06:54:41.0260000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[2325]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-29T06:54:41.2000000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[2326]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-29T06:54:41.2110000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[2327]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-29T06:54:41.2110000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[2328]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:41.3330000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\WINDOWS\ServiceProfiles\NetworkService\NTUSER.DAT was cleared updating 155 keys and creating 18 modified pages. 

Event[2329]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:42.0360000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \SystemRoot\System32\Config\BBI was cleared updating 266 keys and creating 69 modified pages. 

Event[2330]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:42.0410000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\WINDOWS\ServiceProfiles\LocalService\NTUSER.DAT was cleared updating 169 keys and creating 22 modified pages. 

Event[2331]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-29T06:54:42.1570000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2332]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-29T06:54:42.2050000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2333]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-29T06:54:42.2150000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2334]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-29T06:54:42.2320000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2335]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-29T06:54:42.2590000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2336]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-29T06:54:42.2590000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[2337]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-29T06:54:42.2590000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2338]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-29T06:54:42.2610000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2339]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-29T06:54:42.2690000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2340]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-29T06:54:42.2810000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2341]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-29T06:54:42.6860000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[2342]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-29T06:54:42.6860000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[2343]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-29T06:54:42.6860000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[2344]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-29T06:54:42.7110000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[2345]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-29T06:54:42.8180000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[2346]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-29T06:54:42.9450000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2347]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-29T06:54:42.9450000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2348]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-29T06:54:42.9450000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2349]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-29T06:54:42.9450000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2350]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-29T06:54:42.9450000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2351]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-29T06:54:42.9450000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2352]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-29T06:54:42.9450000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2353]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-29T06:54:42.9450000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2354]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-29T06:54:42.9450000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2355]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-29T06:54:42.9450000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2356]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-29T06:54:42.9450000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2357]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-29T06:54:42.9450000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2358]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-29T06:54:42.9450000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2359]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-29T06:54:42.9450000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2360]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:42.9680000Z
  Event ID: 15
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Hive \SystemRoot\System32\config\DRIVERS was reorganized with a starting size of 11599872 bytes and an ending size of 10153984 bytes. 

Event[2361]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:43.1720000Z
  Event ID: 15
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Hive \??\C:\Users\aaron\ntuser.dat was reorganized with a starting size of 12615680 bytes and an ending size of 12800000 bytes. 

Event[2362]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:43.2470000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Microsoft\Windows\UsrClass.dat was cleared updating 3156 keys and creating 434 modified pages. 

Event[2363]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-29T06:54:43.2720000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[2364]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-29T06:54:45.6540000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[2365]
  Log Name: System
  Source: TPM
  Date: 2025-09-29T06:54:45.6580000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[2366]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-29T06:54:45.8000000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[2367]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:45.8220000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\WINDOWS\AppCompat\Programs\Amcache.hve was cleared updating 1827 keys and creating 647 modified pages. 

Event[2368]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-29T06:54:45.8220000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2369]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-29T06:54:45.8320000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2370]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-29T06:54:45.8880000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[2371]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-29T06:54:47.7970000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[2372]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-29T06:54:47.7970000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000023-0000000000.json for detailed information on what checks were made. 

Event[2373]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:48.8180000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\User.dat was cleared updating 28 keys and creating 4 modified pages. 

Event[2374]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:48.8230000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\UserClasses.dat was cleared updating 17 keys and creating 2 modified pages. 

Event[2375]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:48.9000000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat was cleared updating 17 keys and creating 5 modified pages. 

Event[2376]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:49.5500000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat was cleared updating 16 keys and creating 1 modified pages. 

Event[2377]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:49.8410000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat was cleared updating 5 keys and creating 1 modified pages. 

Event[2378]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:50.0340000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\Settings\settings.dat was cleared updating 6 keys and creating 1 modified pages. 

Event[2379]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:54:52.3680000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages. 

Event[2380]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-29T06:54:53.3600000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[2381]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-29T06:54:54.0160000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[2382]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-29T06:55:21.5150000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2383]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:55:42.2110000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat was cleared updating 241 keys and creating 21 modified pages. 

Event[2384]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-29T06:55:47.5600000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2385]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-29T06:55:47.5600000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2386]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-29T06:55:47.5600000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2387]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-29T06:55:47.5760000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2388]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-29T06:55:47.5920000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2389]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-29T06:55:47.5920000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2390]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-29T06:55:47.5920000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2391]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-29T06:55:47.5920000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2392]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:55:55.4400000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 17 keys and creating 4 modified pages. 

Event[2393]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T06:56:46.0140000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\dosvcState.dat was cleared updating 33 keys and creating 9 modified pages. 

Event[2394]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-29T06:56:47.4070000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2395]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-29T06:56:47.4070000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2396]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-29T06:59:42.9560000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[2397]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-29T06:59:42.9560000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[2398]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-29T07:02:20.3990000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2399]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-29T07:02:45.1720000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[2400]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-29T07:05:09.5360000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2401]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-29T07:05:59.9920000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[2402]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-29T07:07:15.6630000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.203.0) - Current Channel (Broad) 

Event[2403]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-29T07:07:29.3580000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.203.0) - Current Channel (Broad) 

Event[2404]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-29T07:36:40.1610000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[2405]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-29T07:38:50.2820000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[2406]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T07:46:43.3980000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\SystemAppData\Helium\User.dat was cleared updating 7 keys and creating 1 modified pages. 

Event[2407]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T07:46:43.4030000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat was cleared updating 5 keys and creating 1 modified pages. 

Event[2408]
  Log Name: System
  Source: Tcpip
  Date: 2025-09-29T07:53:04.2150000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[2409]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-29T09:22:11.7960000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[2410]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-29T09:22:45.2120000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[2411]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T09:31:11.7490000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 2 keys and creating 1 modified pages. 

Event[2412]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T09:53:22.9540000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[2413]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-29T09:53:23.8060000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[2414]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-29T09:53:48.6890000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2415]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-29T09:53:48.8600000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[2416]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-29T09:55:29.9100000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[2417]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-29T10:06:19.4710000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[2418]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-29T10:08:23.6470000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[2419]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-29T10:11:08.7190000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2420]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-29T10:28:12.7330000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2421]
  Log Name: System
  Source: EventLog
  Date: 2025-09-29T10:30:00.4230000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 12926 seconds. 

Event[2422]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-29T10:45:16.7410000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2423]
  Log Name: System
  Source: Tcpip
  Date: 2025-09-29T10:51:30.7140000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[2424]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-29T10:55:56.3540000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[2425]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-29T11:02:20.7600000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2426]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T11:21:21.6840000Z
  Event ID: 15
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Hive \??\C:\WINDOWS\System32\config\COMPONENTS was reorganized with a starting size of 51539968 bytes and an ending size of 42467328 bytes. 

Event[2427]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T11:21:21.7920000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\WINDOWS\System32\SMI\Store\Machine\schema.dat was cleared updating 14625 keys and creating 2483 modified pages. 

Event[2428]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-29T11:30:14.8690000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[2429]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-29T14:26:52.9140000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[2430]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T14:26:55.7960000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[2431]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T14:26:55.7960000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?09?-?29T10:26:55.796316600Z from ?2025?-?09?-?29T10:26:52.920493900Z.
Time Delta: 2875 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 11944).

RTC time: ?2025?-?09?-?29T15:56:55.796316600Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[2432]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-29T14:26:55.7960000Z
  Event ID: 35
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time service is now synchronizing the system time with the time source time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123) with reference id 3611644667. Current local stratum number is 4. 

Event[2433]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T14:26:55.7970000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[2434]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T14:26:55.7970000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?09?-?29T10:26:55.797337500Z from ?2025?-?09?-?29T10:26:55.796609400Z.
Time Delta: 0 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 11944).

RTC time: ?2025?-?09?-?29T15:56:55.797337500Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[2435]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T14:26:55.7990000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[2436]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T14:26:55.7990000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?09?-?29T10:26:55.798889400Z from ?2025?-?09?-?29T10:26:55.798706400Z.
Time Delta: 0 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 11944).

RTC time: ?2025?-?09?-?29T15:56:55.798889400Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[2437]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-29T15:55:56.5100000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[2438]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-29T15:58:01.3020000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[2439]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-29T16:56:10.7780000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[2440]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-29T16:58:14.9370000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[2441]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-29T17:27:21.6230000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[2442]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-29T17:47:41.5880000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[2443]
  Log Name: System
  Source: User32
  Date: 2025-09-29T17:57:28.7880000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[2444]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-29T17:57:29.9380000Z
  Event ID: 10010
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The server {38E441FB-3D16-422F-8750-B2DACEC5CEFC} did not register with DCOM within the required timeout. 

Event[2445]
  Log Name: System
  Source: EventLog
  Date: 2025-09-29T17:57:32.3450000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[2446]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-29T17:57:31.7810000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[2447]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-29T17:57:31.8700000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[2448]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-29T17:57:32.2710000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[2449]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-29T17:57:32.3370000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[2450]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-29T17:57:32.3370000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[2451]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-29T17:57:32.3390000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[2452]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-29T17:57:32.3410000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[2453]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-29T17:57:32.3650000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[2454]
  Log Name: System
  Source: EventLog
  Date: 2025-09-30T06:03:25.4570000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[2455]
  Log Name: System
  Source: EventLog
  Date: 2025-09-30T06:03:25.4580000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[2456]
  Log Name: System
  Source: EventLog
  Date: 2025-09-30T06:03:25.4590000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[2457]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-29T17:57:32.6010000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[2458]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-29T17:57:32.6490000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[2459]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-29T17:57:33.2750000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[2460]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-29T17:57:33.2750000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[2461]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-29T17:57:37.3060000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[2462]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-29T17:57:37.9840000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[2463]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-29T17:57:38.1280000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?09?-?29T13:57:38.128506600Z. 

Event[2464]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-30T06:03:19.9100000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?09?-?30T02:03:19.500000000Z. 

Event[2465]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-30T06:03:19.9100000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?09?-?30T02:03:19.500000000Z. 

Loader time: ?2025?-?09?-?30T02:03:18.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[2466]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-30T06:03:19.9110000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[2467]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-30T06:03:19.9110000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[2468]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-30T06:03:19.9110000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[2469]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-30T06:03:19.9110000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[2470]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-30T06:03:19.9110000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[2471]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-30T06:03:19.9110000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?09?-?30T07:33:18.000000000Z. 

Event[2472]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-30T06:03:19.9110000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[2473]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-30T06:03:19.9110000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[2474]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-09-30T06:03:19.9150000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[2475]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-30T06:03:19.9150000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[2476]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-09-30T06:03:19.9610000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[2477]
  Log Name: System
  Source: Application Popup
  Date: 2025-09-30T06:03:20.1100000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[2478]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-30T06:03:20.3350000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2479]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-30T06:03:20.3360000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2480]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-30T06:03:20.3370000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2481]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-30T06:03:20.9040000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[2482]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-30T06:03:21.0990000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2483]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-30T06:03:21.1050000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2484]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-30T06:03:21.2970000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2485]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-30T06:03:21.3530000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[2486]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-30T06:03:21.3530000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[2487]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-30T06:03:21.3590000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[2488]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-30T06:03:22.1110000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[2489]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-30T06:03:22.1540000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2490]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-30T06:03:22.1620000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2491]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-30T06:03:22.1640000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2492]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-30T06:03:22.1740000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2493]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-30T06:03:22.1750000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[2494]
  Log Name: System
  Source: Netwtw04
  Date: 2025-09-30T06:03:22.1750000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[2495]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-30T06:03:22.1810000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2496]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-30T06:03:22.1870000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2497]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-30T06:03:22.1880000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2498]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-30T06:03:22.2450000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2499]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-30T06:03:22.3150000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[2500]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-30T06:03:22.3890000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[2501]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-30T06:03:22.8530000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[2502]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-30T06:03:23.0590000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[2503]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-30T06:03:23.1440000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[2504]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-30T06:03:24.0170000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[2505]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-30T06:03:24.0170000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[2506]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-30T06:03:24.0170000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[2507]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-30T06:03:24.0180000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[2508]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-30T06:03:24.1110000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[2509]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-09-30T06:03:24.1120000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[2510]
  Log Name: System
  Source: LsaSrv
  Date: 2025-09-30T06:03:24.1640000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[2511]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-30T06:03:24.3350000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[2512]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-30T06:03:24.3460000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[2513]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-09-30T06:03:24.3460000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[2514]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-30T06:03:25.3020000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2515]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-30T06:03:25.3080000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2516]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-30T06:03:25.3180000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2517]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-30T06:03:25.3340000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2518]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-30T06:03:25.3540000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2519]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-30T06:03:25.3540000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[2520]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-30T06:03:25.3540000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2521]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-30T06:03:25.3590000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2522]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-30T06:03:25.3680000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2523]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-30T06:03:25.3760000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2524]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-30T06:03:25.6770000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[2525]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-30T06:03:25.6770000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[2526]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-30T06:03:25.6770000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[2527]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-30T06:03:25.7120000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[2528]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-30T06:03:25.9090000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[2529]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-30T06:03:25.9390000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2530]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-30T06:03:25.9390000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2531]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-30T06:03:25.9390000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2532]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-30T06:03:25.9390000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2533]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-30T06:03:25.9390000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2534]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-30T06:03:25.9390000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2535]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-30T06:03:25.9390000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2536]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-30T06:03:25.9390000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2537]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-30T06:03:25.9390000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2538]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-30T06:03:25.9390000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2539]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-30T06:03:25.9390000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2540]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-30T06:03:25.9390000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2541]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-30T06:03:25.9390000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2542]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-09-30T06:03:25.9390000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2543]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-30T06:03:26.3550000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[2544]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-30T06:03:28.2870000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[2545]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-30T06:03:28.4240000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[2546]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-30T06:03:28.4590000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[2547]
  Log Name: System
  Source: TPM
  Date: 2025-09-30T06:03:30.2340000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[2548]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-30T06:03:31.4250000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\SystemAppData\Helium\User.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[2549]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-30T06:03:31.4300000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat was cleared updating 15 keys and creating 3 modified pages. 

Event[2550]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-30T06:03:31.7010000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[2551]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-30T06:03:31.7010000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000024-0000000000.json for detailed information on what checks were made. 

Event[2552]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-30T06:03:36.9620000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[2553]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-30T06:03:37.4540000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[2554]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-30T06:03:43.1430000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\AppleInc.iTunes_nzyj5cx40ttqa\SystemAppData\Helium\User.dat was cleared updating 8 keys and creating 1 modified pages. 

Event[2555]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-30T06:03:43.1490000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\AppleInc.iTunes_nzyj5cx40ttqa\SystemAppData\Helium\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[2556]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-30T06:03:54.2470000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2557]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-30T06:04:33.3240000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2558]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-30T06:04:33.3240000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2559]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-30T06:04:33.3240000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2560]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-30T06:04:33.3390000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2561]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-30T06:04:33.3390000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2562]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-30T06:04:33.3540000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2563]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-30T06:04:33.3540000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2564]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-09-30T06:04:33.3700000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2565]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-30T06:04:34.4340000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[2566]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-09-30T06:04:39.1340000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2567]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-30T06:05:16.4290000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2568]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-30T06:05:16.4310000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2569]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-30T06:05:16.4320000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2570]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-30T06:05:16.4340000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2571]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-30T06:05:29.5930000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2572]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-30T06:05:29.5930000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2573]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-30T06:05:29.5940000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2574]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-30T06:06:12.9020000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[2575]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-30T06:06:50.7370000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[2576]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-30T06:08:26.0670000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[2577]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-30T06:08:26.0670000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[2578]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-30T06:20:11.7710000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[2579]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-30T06:20:37.5100000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2580]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-30T06:20:41.2680000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.214.0) - Current Channel (Broad) 

Event[2581]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-30T06:20:56.6770000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.214.0) - Current Channel (Broad) 

Event[2582]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-30T06:54:05.4290000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[2583]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-30T06:54:35.5860000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2584]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-30T06:54:35.6980000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[2585]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-30T06:55:53.0650000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from demand start to auto start. 

Event[2586]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-30T06:55:58.4910000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from auto start to demand start. 

Event[2587]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-30T07:11:55.6020000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2588]
  Log Name: System
  Source: Tcpip
  Date: 2025-09-30T07:26:03.7180000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[2589]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-30T07:28:59.6150000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2590]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-30T07:46:03.6360000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2591]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-30T08:03:07.6570000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2592]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-30T08:03:51.5340000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name 9.rarbg.me timed out after none of the configured DNS servers responded. Client PID 9288. 

Event[2593]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-30T08:04:02.9190000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name 9.rarbg.me timed out after none of the configured DNS servers responded. Client PID 9288. 

Event[2594]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-30T08:04:39.9210000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[2595]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-30T08:06:56.1710000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[2596]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-30T08:21:31.1540000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[2597]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-30T08:28:52.2430000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name 9.rarbg.me timed out after none of the configured DNS servers responded. Client PID 9288. 

Event[2598]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-30T08:50:58.7230000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name 9.rarbg.me timed out after none of the configured DNS servers responded. Client PID 9288. 

Event[2599]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-30T09:02:37.9290000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[2600]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-30T09:30:18.0060000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name 9.rarbg.me timed out after none of the configured DNS servers responded. Client PID 9288. 

Event[2601]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-30T10:06:04.0460000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[2602]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-30T10:06:04.0460000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[2603]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-30T10:11:45.1640000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\SystemAppData\Helium\User.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[2604]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-30T10:11:45.1690000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat was cleared updating 2 keys and creating 1 modified pages. 

Event[2605]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-30T10:14:25.5670000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2606]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-30T10:17:49.1650000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.StartExperiencesApp_1.140.0.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[2607]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-09-30T10:18:00.4500000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume ?? (\Device\HarddiskVolumeShadowCopy3) is healthy.  No action is needed. 

Event[2608]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-30T10:18:00.7200000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: 9PC1H9VN18CM-Microsoft.StartExperiencesApp 

Event[2609]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-30T10:18:01.1090000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.StartExperiencesApp_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[2610]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-30T10:18:02.6050000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: 9PC1H9VN18CM-Microsoft.StartExperiencesApp 

Event[2611]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-30T10:24:35.4720000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name 9.rarbg.me timed out after none of the configured DNS servers responded. Client PID 9288. 

Event[2612]
  Log Name: System
  Source: EventLog
  Date: 2025-09-30T10:30:00.4650000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 16000 seconds. 

Event[2613]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-30T10:45:14.2940000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.StorePurchaseApp_22508.1401.2.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[2614]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-30T10:45:15.4740000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: 9NBLGGH4LS1F-Microsoft.StorePurchaseApp 

Event[2615]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-30T10:45:15.7520000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[2616]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-30T10:45:16.4110000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: 9NBLGGH4LS1F-Microsoft.StorePurchaseApp 

Event[2617]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-30T11:01:33.7250000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[2618]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-30T11:15:16.1270000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[2619]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-30T11:21:09.1060000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[2620]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-30T11:24:54.1500000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name 9.rarbg.me timed out after none of the configured DNS servers responded. Client PID 9288. 

Event[2621]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-30T11:27:39.8270000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[2622]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-09-30T11:27:39.8320000Z
  Event ID: 35
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time service is now synchronizing the system time with the time source time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123) with reference id 3611644667. Current local stratum number is 4. 

Event[2623]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-30T11:27:39.8330000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[2624]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-30T11:27:39.8330000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?09?-?30T07:27:39.832982700Z from ?2025?-?09?-?30T07:27:39.832125900Z.
Time Delta: 0 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 7180).

RTC time: ?2025?-?09?-?30T12:57:39.832982700Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[2625]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-30T11:49:00.4250000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[2626]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-30T11:51:13.4780000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[2627]
  Log Name: System
  Source: Tcpip
  Date: 2025-09-30T11:58:44.2220000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[2628]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-30T12:09:50.6090000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[2629]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-30T12:25:12.7170000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name 9.rarbg.me timed out after none of the configured DNS servers responded. Client PID 9288. 

Event[2630]
  Log Name: System
  Source: BTHUSB
  Date: 2025-09-30T13:16:55.9260000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[2631]
  Log Name: System
  Source: BTHUSB
  Date: 2025-09-30T13:16:55.9650000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[2632]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-09-30T13:25:36.5140000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name 9.rarbg.me timed out after none of the configured DNS servers responded. Client PID 9288. 

Event[2633]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-09-30T14:13:12.7070000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2634]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-30T14:13:13.0410000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Intel(R) Content Protection HECI Service service terminated with the following error: 
Unspecified error 

Event[2635]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-30T14:30:18.0920000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[2636]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-30T14:55:37.2390000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[2637]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-30T15:55:56.6340000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[2638]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-30T15:58:01.2720000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[2639]
  Log Name: System
  Source: Tcpip
  Date: 2025-09-30T16:23:55.2260000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[2640]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-30T16:54:15.6530000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[2641]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-30T16:56:19.8290000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[2642]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-30T17:57:17.9280000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[2643]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-30T18:08:26.0680000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[2644]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-09-30T18:08:26.0680000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[2645]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-30T18:23:45.3560000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[2646]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-30T18:24:41.4340000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.231.0) - Current Channel (Broad) 

Event[2647]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-09-30T18:24:54.2530000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.231.0) - Current Channel (Broad) 

Event[2648]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-09-30T18:41:08.0770000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[2649]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-09-30T18:50:10.3860000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[2650]
  Log Name: System
  Source: User32
  Date: 2025-09-30T18:51:49.9360000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[2651]
  Log Name: System
  Source: EventLog
  Date: 2025-09-30T18:51:51.8920000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[2652]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-09-30T18:51:51.4450000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[2653]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-30T18:51:51.8190000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[2654]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-30T18:51:51.8820000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[2655]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-30T18:51:51.8830000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[2656]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-30T18:51:51.8850000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[2657]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-09-30T18:51:51.8860000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[2658]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-09-30T18:51:51.8940000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[2659]
  Log Name: System
  Source: EventLog
  Date: 2025-10-01T07:46:50.5520000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[2660]
  Log Name: System
  Source: EventLog
  Date: 2025-10-01T07:46:50.5520000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[2661]
  Log Name: System
  Source: EventLog
  Date: 2025-10-01T07:46:50.5530000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 6 seconds. 

Event[2662]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-30T18:51:52.1130000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[2663]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-09-30T18:51:52.1610000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[2664]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-30T18:51:52.3290000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[2665]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-30T18:51:52.8340000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[2666]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-09-30T18:51:52.8340000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[2667]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-09-30T18:51:54.8920000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[2668]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-09-30T18:51:55.1170000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?09?-?30T14:51:55.117988500Z. 

Event[2669]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-01T07:46:44.8950000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?01T03:46:44.500000000Z. 

Event[2670]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-01T07:46:44.8950000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?01T03:46:44.500000000Z. 

Loader time: ?2025?-?10?-?01T03:46:43.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[2671]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-01T07:46:44.8960000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[2672]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-01T07:46:44.8960000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[2673]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-01T07:46:44.8960000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[2674]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-01T07:46:44.8960000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[2675]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-01T07:46:44.8960000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[2676]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-01T07:46:44.8960000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?01T09:16:43.000000000Z. 

Event[2677]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-01T07:46:44.8960000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[2678]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-01T07:46:44.8960000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[2679]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-01T07:46:44.9000000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[2680]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-01T07:46:44.9000000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[2681]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-01T07:46:44.9410000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[2682]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-01T07:46:45.0900000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[2683]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-01T07:46:45.3000000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2684]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-01T07:46:45.3010000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2685]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-01T07:46:45.3030000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2686]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-01T07:46:45.7880000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[2687]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-01T07:46:45.9740000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2688]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-01T07:46:45.9790000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2689]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-01T07:46:46.1770000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2690]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-01T07:46:46.2330000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[2691]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-01T07:46:46.2330000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[2692]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-01T07:46:46.2380000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[2693]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-01T07:46:46.9850000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[2694]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-01T07:46:47.0270000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2695]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-01T07:46:47.0360000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2696]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-01T07:46:47.0370000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2697]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-01T07:46:47.0480000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[2698]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-01T07:46:47.0480000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[2699]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-01T07:46:47.0540000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2700]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-01T07:46:47.0550000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2701]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-01T07:46:47.0570000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2702]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-01T07:46:47.0580000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2703]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-01T07:46:47.0900000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2704]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-01T07:46:47.0950000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[2705]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-01T07:46:47.1490000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[2706]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-01T07:46:47.7670000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[2707]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-01T07:46:47.9760000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[2708]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-01T07:46:48.0650000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[2709]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-01T07:46:48.7620000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[2710]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-01T07:46:48.8060000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[2711]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-01T07:46:48.9630000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[2712]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-01T07:46:48.9630000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[2713]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-01T07:46:48.9630000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[2714]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-01T07:46:48.9650000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[2715]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-01T07:46:49.0790000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[2716]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-01T07:46:49.0800000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[2717]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-01T07:46:49.1400000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[2718]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-01T07:46:49.3490000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[2719]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-01T07:46:49.3620000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[2720]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-01T07:46:49.3620000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[2721]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-01T07:46:50.3320000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2722]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-01T07:46:50.3570000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2723]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-01T07:46:50.3680000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2724]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-01T07:46:50.3850000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2725]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-01T07:46:50.4050000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2726]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-01T07:46:50.4050000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[2727]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-01T07:46:50.4050000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2728]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-01T07:46:50.4120000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2729]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-01T07:46:50.4200000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2730]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-01T07:46:50.4290000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2731]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-01T07:46:50.8050000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[2732]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-01T07:46:50.8050000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[2733]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-01T07:46:50.8050000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[2734]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-01T07:46:50.8390000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[2735]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-01T07:46:50.9450000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[2736]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-01T07:46:51.0410000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2737]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-01T07:46:51.0410000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2738]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-01T07:46:51.0410000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2739]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-01T07:46:51.0410000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2740]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-01T07:46:51.0410000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2741]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-01T07:46:51.0410000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2742]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-01T07:46:51.0410000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2743]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-01T07:46:51.0410000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2744]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-01T07:46:51.0410000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2745]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-01T07:46:51.0410000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2746]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-01T07:46:51.0410000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2747]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-01T07:46:51.0410000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2748]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-01T07:46:51.0410000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2749]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-01T07:46:51.0410000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2750]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-01T07:46:51.4070000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[2751]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-01T07:46:53.0780000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[2752]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-01T07:46:53.0780000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000025-0000000000.json for detailed information on what checks were made. 

Event[2753]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-01T07:46:53.5580000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[2754]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-01T07:46:53.6810000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[2755]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-01T07:46:53.7130000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[2756]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-01T07:46:54.2240000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2757]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-01T07:46:54.2320000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2758]
  Log Name: System
  Source: TPM
  Date: 2025-10-01T07:46:55.2350000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[2759]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-01T07:46:57.2400000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[2760]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-01T07:46:58.0330000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[2761]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-01T07:47:13.9110000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2762]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-01T07:47:28.1890000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2763]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-01T07:47:58.1870000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2764]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-01T07:47:58.2030000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2765]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-01T07:47:58.2030000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2766]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-01T07:47:58.2190000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2767]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-01T07:47:58.2190000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2768]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-01T07:47:58.2190000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2769]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-01T07:47:58.2190000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2770]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-01T07:47:58.2190000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2771]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-01T07:48:55.0500000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2772]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-01T07:48:55.0500000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2773]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-01T07:49:27.1900000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[2774]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-01T07:51:51.0840000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[2775]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-01T07:51:51.0840000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[2776]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-01T07:52:32.7660000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 5 keys and creating 1 modified pages. 

Event[2777]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-01T08:18:54.1230000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2778]
  Log Name: System
  Source: Tcpip
  Date: 2025-10-01T08:38:54.2190000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[2779]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-01T08:39:11.8130000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name 9.rarbg.me timed out after none of the configured DNS servers responded. Client PID 7120. 

Event[2780]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-01T08:39:35.4430000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name 9.rarbg.me timed out after none of the configured DNS servers responded. Client PID 7120. 

Event[2781]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-01T08:51:28.7250000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[2782]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-01T09:00:01.3280000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name 9.rarbg.me timed out after none of the configured DNS servers responded. Client PID 7120. 

Event[2783]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-01T09:08:59.3710000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2784]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-01T09:08:59.8230000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Intel(R) Content Protection HECI Service service terminated with the following error: 
Unspecified error 

Event[2785]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-01T09:14:32.5790000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[2786]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-01T09:16:02.8180000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2787]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-01T09:16:05.1960000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[2788]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-01T09:16:20.8050000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[2789]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-01T09:16:20.8050000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?01T05:16:20.804772000Z from ?2025?-?10?-?01T05:16:18.839116900Z.
Time Delta: 1965 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 9560).

RTC time: ?2025?-?10?-?01T10:46:20.804772000Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[2790]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-01T09:16:20.8050000Z
  Event ID: 35
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time service is now synchronizing the system time with the time source time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123) with reference id 3611644667. Current local stratum number is 4. 

Event[2791]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-01T09:16:20.8060000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[2792]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-01T09:16:20.8060000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?01T05:16:20.805767500Z from ?2025?-?10?-?01T05:16:20.804772000Z.
Time Delta: 0 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 9560).

RTC time: ?2025?-?10?-?01T10:46:20.805767500Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[2793]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-01T09:16:20.8070000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[2794]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-01T09:16:20.8070000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?01T05:16:20.806994400Z from ?2025?-?10?-?01T05:16:20.806208900Z.
Time Delta: 0 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 9560).

RTC time: ?2025?-?10?-?01T10:46:20.806994400Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[2795]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-01T09:39:28.2150000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name 9.rarbg.me timed out after none of the configured DNS servers responded. Client PID 7120. 

Event[2796]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-01T09:57:57.8970000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[2797]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-01T09:59:14.6250000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2798]
  Log Name: System
  Source: EventLog
  Date: 2025-10-01T10:30:00.8170000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 9794 seconds. 

Event[2799]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-01T10:31:11.4880000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\1a714a01dc9b411f_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[2800]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-01T10:37:32.2330000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name 9.rarbg.me timed out after none of the configured DNS servers responded. Client PID 7120. 

Event[2801]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-01T11:41:50.6160000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[2802]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-01T11:44:28.1510000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.DesktopAppInstaller_1.26.510.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[2803]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-01T11:44:29.7040000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: 9NBLGGH4NNS1-Microsoft.DesktopAppInstaller 

Event[2804]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-01T11:44:31.0120000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: 9NBLGGH4NNS1-Microsoft.DesktopAppInstaller 

Event[2805]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-01T12:09:16.3960000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[2806]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-01T12:11:23.0450000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[2807]
  Log Name: System
  Source: Tcpip
  Date: 2025-10-01T12:17:20.1720000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[2808]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-01T12:42:05.6580000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[2809]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-01T13:13:48.8650000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[2810]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-01T13:27:22.6560000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[2811]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-01T13:28:11.3980000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[2812]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-01T13:41:44.8680000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[2813]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-01T13:49:46.9200000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[2814]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-01T13:51:07.8490000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[2815]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-01T13:51:23.2730000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[2816]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-10-01T13:52:53.7720000Z
  Event ID: 10121
  Task: User-mode Driver problems. 
  Level: Critical 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
A runtime failure has occurred in user-mode driver AppleUsbFilter.dll and the hosting process has been terminated. This may temporarily interrupt your ability to access the devices. Please contact the device manufacturer or driver vendor for more information about this problem. 

Event[2817]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-10-01T13:52:53.7740000Z
  Event ID: 10120
  Task: User-mode Driver problems. 
  Level: Critical 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A problem has occurred with one or more user-mode drivers and the hosting process has been terminated.  This may temporarily interrupt your ability to access the devices. 

Event[2818]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-10-01T13:52:53.8250000Z
  Event ID: 10116
  Task: User-mode Driver problems. 
  Level: Critical 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The device Apple iPhone (location 0000.0014.0000.002.000.000.000.000.000) is offline due to a user-mode driver crash.  Windows will attempt to restart the device in the shared process 1 more times before moving the device in its own process.  Please contact the device manufacturer for more information about this problem. 

Event[2819]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-10-01T13:52:53.8260000Z
  Event ID: 10116
  Task: User-mode Driver problems. 
  Level: Critical 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The device Apple Mobile Device USB Device (location 0000.0014.0000.002.000.000.000.000.000) is offline due to a user-mode driver crash.  Windows will attempt to restart the device in the shared process 1 more times before moving the device in its own process.  Please contact the device manufacturer for more information about this problem. 

Event[2820]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-01T13:53:24.3600000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[2821]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-01T13:54:24.6940000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[2822]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-01T14:14:29.0990000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[2823]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-01T14:22:10.9620000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[2824]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-01T14:39:19.8300000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2825]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-01T14:39:27.8820000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[2826]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-01T14:41:40.0790000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[2827]
  Log Name: System
  Source: Tcpip
  Date: 2025-10-01T15:28:36.6780000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[2828]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-01T15:55:56.6630000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[2829]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-01T15:58:01.4320000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[2830]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-01T17:03:26.0830000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[2831]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-01T17:05:30.2680000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[2832]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-01T17:51:29.7110000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat was cleared updating 2 keys and creating 1 modified pages. 

Event[2833]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-01T18:50:26.5060000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[2834]
  Log Name: System
  Source: User32
  Date: 2025-10-01T19:04:07.4080000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[2835]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-01T19:04:08.3990000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[2836]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-01T19:04:08.6100000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[2837]
  Log Name: System
  Source: EventLog
  Date: 2025-10-01T19:04:25.0560000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[2838]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-01T19:04:24.9420000Z
  Event ID: 7043
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Windows Security Service service did not shut down properly after receiving a preshutdown control. 

Event[2839]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-01T19:04:24.9890000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[2840]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-01T19:04:25.0390000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[2841]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-01T19:04:25.0400000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[2842]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-01T19:04:25.0430000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[2843]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-01T19:04:25.0500000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[2844]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-01T19:04:25.0520000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[2845]
  Log Name: System
  Source: EventLog
  Date: 2025-10-02T07:21:40.5270000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[2846]
  Log Name: System
  Source: EventLog
  Date: 2025-10-02T07:21:40.5280000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[2847]
  Log Name: System
  Source: EventLog
  Date: 2025-10-02T07:21:40.5290000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 6 seconds. 

Event[2848]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-01T19:04:25.3000000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[2849]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-01T19:04:25.3340000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[2850]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-01T19:04:25.9950000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[2851]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-01T19:04:25.9950000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[2852]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-01T19:04:29.9940000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[2853]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-01T19:04:32.4210000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[2854]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-01T19:04:32.5890000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?01T15:04:32.589621700Z. 

Event[2855]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-02T07:21:34.8940000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?02T03:21:34.500000000Z. 

Event[2856]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-02T07:21:34.8940000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?02T03:21:34.500000000Z. 

Loader time: ?2025?-?10?-?02T03:21:33.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[2857]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-02T07:21:34.8940000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[2858]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-02T07:21:34.8940000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[2859]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-02T07:21:34.8940000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[2860]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-02T07:21:34.8940000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[2861]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-02T07:21:34.8940000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[2862]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-02T07:21:34.8940000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?02T08:51:33.000000000Z. 

Event[2863]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-02T07:21:34.8940000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[2864]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-02T07:21:34.8940000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[2865]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-02T07:21:34.8980000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[2866]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-02T07:21:34.8980000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[2867]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-02T07:21:34.9300000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[2868]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-02T07:21:35.0790000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[2869]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-02T07:21:35.2880000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2870]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-02T07:21:35.2890000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2871]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-02T07:21:35.2910000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2872]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-02T07:21:35.8090000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[2873]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-02T07:21:35.9890000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2874]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-02T07:21:35.9940000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2875]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-02T07:21:36.1880000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2876]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-02T07:21:36.2430000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[2877]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-02T07:21:36.2430000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[2878]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-02T07:21:36.2460000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[2879]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-02T07:21:36.9720000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[2880]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-02T07:21:37.0150000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2881]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-02T07:21:37.0240000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2882]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-02T07:21:37.0250000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2883]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-02T07:21:37.0340000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2884]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-02T07:21:37.0370000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2885]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-02T07:21:37.0370000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[2886]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-02T07:21:37.0370000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[2887]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-02T07:21:37.0400000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2888]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-02T07:21:37.0420000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2889]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-02T07:21:37.0770000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[2890]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-02T07:21:37.0810000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[2891]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-02T07:21:37.1440000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[2892]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-02T07:21:37.7940000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[2893]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-02T07:21:38.0000000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[2894]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-02T07:21:38.1040000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[2895]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-02T07:21:38.9250000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[2896]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-02T07:21:38.9630000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[2897]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-02T07:21:38.9910000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[2898]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-02T07:21:38.9910000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[2899]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-02T07:21:38.9910000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[2900]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-02T07:21:38.9930000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[2901]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-02T07:21:39.0960000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[2902]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-02T07:21:39.0970000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[2903]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-02T07:21:39.1560000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[2904]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-02T07:21:39.3350000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[2905]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-02T07:21:39.3450000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[2906]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-02T07:21:39.3450000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[2907]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-02T07:21:40.3220000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2908]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-02T07:21:40.3430000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2909]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-02T07:21:40.3530000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2910]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-02T07:21:40.3710000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2911]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-02T07:21:40.3920000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2912]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-02T07:21:40.3920000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[2913]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-02T07:21:40.3920000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2914]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-02T07:21:40.3970000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2915]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-02T07:21:40.4070000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2916]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-02T07:21:40.4210000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2917]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-02T07:21:40.8080000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[2918]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-02T07:21:40.8080000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[2919]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-02T07:21:40.8080000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[2920]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-02T07:21:40.8420000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[2921]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-02T07:21:40.9200000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[2922]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-02T07:21:41.0490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2923]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-02T07:21:41.0490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2924]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-02T07:21:41.0490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2925]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-02T07:21:41.0490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2926]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-02T07:21:41.0490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2927]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-02T07:21:41.0490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2928]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-02T07:21:41.0490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2929]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-02T07:21:41.0490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2930]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-02T07:21:41.0490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2931]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-02T07:21:41.0490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2932]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-02T07:21:41.0490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2933]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-02T07:21:41.0490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2934]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-02T07:21:41.0490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2935]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-02T07:21:41.0490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[2936]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-02T07:21:41.3660000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[2937]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-02T07:21:42.8450000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[2938]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-02T07:21:42.8460000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000026-0000000000.json for detailed information on what checks were made. 

Event[2939]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-02T07:21:43.1820000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[2940]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-02T07:21:43.3210000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[2941]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-02T07:21:43.3630000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[2942]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-02T07:21:43.8800000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2943]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-02T07:21:43.8830000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2944]
  Log Name: System
  Source: TPM
  Date: 2025-10-02T07:21:45.1950000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[2945]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-02T07:21:46.9730000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[2946]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-02T07:21:49.0270000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[2947]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-02T07:22:03.6560000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2948]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-02T07:22:48.1780000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2949]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-02T07:22:48.1780000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2950]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-02T07:22:48.1780000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2951]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-02T07:22:48.1930000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2952]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-02T07:22:48.2090000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2953]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-02T07:22:48.2090000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2954]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-02T07:22:48.2090000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2955]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-02T07:22:48.2090000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[2956]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-02T07:23:44.9890000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2957]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-02T07:23:44.9890000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2958]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-02T07:24:16.1030000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[2959]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-02T07:24:18.0140000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[2960]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-02T07:25:03.7040000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\DropboxInc.Dropbox_wkt425jdc3sga\SystemAppData\Helium\User.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[2961]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-02T07:25:03.7090000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\DropboxInc.Dropbox_wkt425jdc3sga\SystemAppData\Helium\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[2962]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-02T07:25:48.3700000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2963]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-02T07:26:41.0550000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[2964]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-02T07:26:41.0550000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[2965]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-02T07:32:51.0370000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[2966]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-02T07:33:08.5780000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.259.0) - Current Channel (Broad) 

Event[2967]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-02T07:33:21.8600000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.259.0) - Current Channel (Broad) 

Event[2968]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-02T07:39:11.1040000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name tracker.openbittorrent.com timed out after none of the configured DNS servers responded. Client PID 5780. 

Event[2969]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-02T07:39:14.8690000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name 9.rarbg.me timed out after none of the configured DNS servers responded. Client PID 5780. 

Event[2970]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-02T07:39:54.3060000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[2971]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-02T08:16:33.7370000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[2972]
  Log Name: System
  Source: Tcpip
  Date: 2025-10-02T08:21:28.7210000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[2973]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-02T08:26:19.0520000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[2974]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-02T09:24:08.6740000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[2975]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-02T09:25:39.0460000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2976]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-02T09:25:39.1810000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[2977]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-02T09:42:59.0900000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2978]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-02T09:55:31.7900000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\AppleInc.iTunes_nzyj5cx40ttqa\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages. 

Event[2979]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-02T09:56:09.9100000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\e59fd33af7a9be35_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[2980]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-02T10:00:03.1110000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2981]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-02T10:17:07.1320000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2982]
  Log Name: System
  Source: EventLog
  Date: 2025-10-02T10:30:00.5420000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 11306 seconds. 

Event[2983]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-02T10:34:11.1470000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[2984]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-02T12:22:53.7720000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[2985]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-02T12:23:27.8750000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[2986]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-02T12:24:58.4440000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[2987]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-02T12:25:53.0420000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Paint_11.2508.361.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[2988]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-02T12:25:53.9890000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: 9PCFS5B6T72H-Microsoft.Paint 

Event[2989]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-02T12:25:54.2980000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Paint_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[2990]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-02T12:25:54.9870000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: 9PCFS5B6T72H-Microsoft.Paint 

Event[2991]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-02T13:41:38.5360000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[2992]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-02T13:58:43.1110000Z
  Event ID: 134
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on 'time.windows.com,0x9'. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: No such host is known. (0x80072AF9) 

Event[2993]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-02T13:59:15.9710000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[2994]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-02T13:59:57.6100000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[2995]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-02T13:59:58.6870000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[2996]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-02T13:59:58.6870000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?02T09:59:58.687198100Z from ?2025?-?10?-?02T09:59:57.623818800Z.
Time Delta: 1063 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 1940).

RTC time: ?2025?-?10?-?02T15:29:58.687198100Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[2997]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-02T13:59:58.6870000Z
  Event ID: 35
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time service is now synchronizing the system time with the time source time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123) with reference id 3611644667. Current local stratum number is 4. 

Event[2998]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-02T13:59:58.6880000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[2999]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-02T13:59:58.6880000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?02T09:59:58.687990500Z from ?2025?-?10?-?02T09:59:58.687448800Z.
Time Delta: 0 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 1940).

RTC time: ?2025?-?10?-?02T15:29:58.687990500Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[3000]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-02T13:59:58.6890000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[3001]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-02T13:59:58.6890000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?02T09:59:58.689473400Z from ?2025?-?10?-?02T09:59:58.687990500Z.
Time Delta: 1 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 1940).

RTC time: ?2025?-?10?-?02T15:29:58.689473400Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[3002]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-02T14:00:35.2920000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name tracker.openbittorrent.com timed out after none of the configured DNS servers responded. Client PID 13444. 

Event[3003]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-02T14:00:50.1510000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name 9.rarbg.me timed out after none of the configured DNS servers responded. Client PID 13444. 

Event[3004]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-02T14:23:02.8950000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name 9.rarbg.me timed out after none of the configured DNS servers responded. Client PID 13444. 

Event[3005]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-02T14:37:08.3680000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3006]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-02T14:37:09.0250000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Intel(R) Content Protection HECI Service service terminated with the following error: 
Unspecified error 

Event[3007]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-02T14:40:32.3470000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[3008]
  Log Name: System
  Source: Tcpip
  Date: 2025-10-02T14:54:27.7790000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[3009]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-02T15:39:30.4750000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[3010]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-02T15:55:56.6650000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[3011]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-02T15:58:01.4620000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[3012]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-02T16:15:09.2980000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3013]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-02T16:16:05.6560000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[3014]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-02T17:05:20.4150000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[3015]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-02T17:07:24.6000000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[3016]
  Log Name: System
  Source: User32
  Date: 2025-10-02T18:57:04.2600000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[3017]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-02T18:57:05.2300000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[3018]
  Log Name: System
  Source: EventLog
  Date: 2025-10-02T18:57:05.7800000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[3019]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-02T18:57:05.4260000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[3020]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-02T18:57:05.6990000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[3021]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-02T18:57:05.7690000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[3022]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-02T18:57:05.7690000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[3023]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-02T18:57:05.7710000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[3024]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-02T18:57:05.7710000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[3025]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-02T18:57:05.7710000Z
  Event ID: 51057
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service stop is almost done.DHCP Context Ref count is 1 

Event[3026]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-02T18:57:05.7790000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[3027]
  Log Name: System
  Source: EventLog
  Date: 2025-10-03T07:23:39.5790000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[3028]
  Log Name: System
  Source: EventLog
  Date: 2025-10-03T07:23:39.5800000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[3029]
  Log Name: System
  Source: EventLog
  Date: 2025-10-03T07:23:39.5810000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 6 seconds. 

Event[3030]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-02T18:57:05.9690000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[3031]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-02T18:57:05.9910000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[3032]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-02T18:57:06.2230000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[3033]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-02T18:57:06.7080000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[3034]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-02T18:57:06.7080000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[3035]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-02T18:57:08.7300000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[3036]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-02T18:57:08.8960000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?02T14:57:08.896424700Z. 

Event[3037]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T07:23:33.8910000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?03T03:23:33.500000000Z. 

Event[3038]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T07:23:33.8910000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?03T03:23:33.500000000Z. 

Loader time: ?2025?-?10?-?03T03:23:33.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[3039]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T07:23:33.8910000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[3040]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T07:23:33.8910000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[3041]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T07:23:33.8910000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[3042]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T07:23:33.8920000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[3043]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T07:23:33.8920000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[3044]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T07:23:33.8920000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?03T08:53:33.000000000Z. 

Event[3045]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T07:23:33.8920000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[3046]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T07:23:33.8920000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[3047]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T07:23:33.8960000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[3048]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T07:23:33.8960000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[3049]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-03T07:23:33.9320000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[3050]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-03T07:23:34.0810000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[3051]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T07:23:34.3040000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3052]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T07:23:34.3050000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3053]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T07:23:34.3060000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3054]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-03T07:23:34.8200000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[3055]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T07:23:35.0060000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3056]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T07:23:35.0110000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3057]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T07:23:35.2070000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3058]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T07:23:35.2610000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[3059]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T07:23:35.2610000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[3060]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T07:23:35.2660000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[3061]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-03T07:23:35.9910000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[3062]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T07:23:36.0360000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3063]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T07:23:36.0460000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3064]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T07:23:36.0470000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3065]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T07:23:36.0480000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3066]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-03T07:23:36.0530000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[3067]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-03T07:23:36.0530000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[3068]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T07:23:36.0580000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3069]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T07:23:36.0600000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3070]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T07:23:36.0610000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3071]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T07:23:36.0750000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3072]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T07:23:36.1190000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[3073]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T07:23:36.1850000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[3074]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-03T07:23:36.8230000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[3075]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-03T07:23:37.0350000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[3076]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T07:23:37.1250000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[3077]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-03T07:23:37.9480000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[3078]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-03T07:23:37.9940000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[3079]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T07:23:37.9990000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[3080]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T07:23:37.9990000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[3081]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T07:23:37.9990000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[3082]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T07:23:38.0000000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[3083]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T07:23:38.1070000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[3084]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T07:23:38.1090000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[3085]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-03T07:23:38.1610000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[3086]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-03T07:23:38.3690000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[3087]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-03T07:23:38.3810000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[3088]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-03T07:23:38.3810000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[3089]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T07:23:39.3580000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3090]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T07:23:39.3840000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3091]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T07:23:39.3940000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3092]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T07:23:39.4100000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3093]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T07:23:39.4310000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3094]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T07:23:39.4310000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[3095]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T07:23:39.4310000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3096]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T07:23:39.4360000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3097]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T07:23:39.4440000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3098]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T07:23:39.4520000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3099]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T07:23:39.8550000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[3100]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T07:23:39.8550000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[3101]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T07:23:39.8550000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[3102]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-03T07:23:39.8800000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[3103]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-03T07:23:40.0020000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[3104]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T07:23:40.0720000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3105]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T07:23:40.0720000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3106]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T07:23:40.0720000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3107]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T07:23:40.0720000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3108]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T07:23:40.0720000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3109]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T07:23:40.0720000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3110]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T07:23:40.0720000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3111]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T07:23:40.0720000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3112]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T07:23:40.0720000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3113]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T07:23:40.0720000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3114]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T07:23:40.0720000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3115]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T07:23:40.0720000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3116]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T07:23:40.0720000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3117]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T07:23:40.0720000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3118]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T07:23:40.4640000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[3119]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T07:23:41.7620000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[3120]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T07:23:41.7620000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000027-0000000000.json for detailed information on what checks were made. 

Event[3121]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T07:23:42.2950000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[3122]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-03T07:23:42.4090000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[3123]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-03T07:23:42.4430000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[3124]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T07:23:42.9860000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3125]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T07:23:42.9890000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3126]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T07:23:43.6250000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\c93b3c73e758942_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[3127]
  Log Name: System
  Source: TPM
  Date: 2025-10-03T07:23:44.2020000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[3128]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T07:23:44.9910000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\26fe02ce68e5babf_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[3129]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T07:23:45.3820000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\81d060ca2aba6fa4_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[3130]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T07:23:45.7870000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[3131]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T07:23:46.7860000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[3132]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T07:23:49.9180000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 41 keys and creating 4 modified pages. 

Event[3133]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T07:23:50.3130000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\Helium\User.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[3134]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T07:23:50.3180000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\50b64a559478f671_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[3135]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T07:23:54.7040000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\AppleInc.iTunes_nzyj5cx40ttqa\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\28734fb83f5b5911_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[3136]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T07:24:03.1720000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3137]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T07:24:47.2020000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3138]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T07:24:47.2020000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3139]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T07:24:47.2020000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3140]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T07:24:47.2020000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3141]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T07:24:47.2180000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3142]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T07:24:47.2180000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3143]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T07:24:47.2180000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3144]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T07:24:47.2350000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3145]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T07:25:43.9990000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3146]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T07:25:43.9990000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3147]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T07:28:40.0720000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[3148]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T07:28:40.0720000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[3149]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T07:33:49.5180000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[3150]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T07:35:38.2040000Z
  Event ID: 11
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy3\WINDOWS\System32\config\SYSTEM (TM: {5769a457-a008-11f0-a0bd-e09467ee0d58}, RM: {5769a456-a008-11f0-a0bd-e09467ee0d58}) finished with result=0xC00000A2 (Internal code=7). 

Event[3151]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T07:35:38.2740000Z
  Event ID: 11
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy3\WINDOWS\System32\config\DRIVERS (TM: {5769a45a-a008-11f0-a0bd-e09467ee0d58}, RM: {5769a459-a008-11f0-a0bd-e09467ee0d58}) finished with result=0xC00000A2 (Internal code=7). 

Event[3152]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T07:35:39.0520000Z
  Event ID: 11
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy3\WINDOWS\System32\config\SOFTWARE (TM: {5769a45d-a008-11f0-a0bd-e09467ee0d58}, RM: {5769a45c-a008-11f0-a0bd-e09467ee0d58}) finished with result=0xC00000A2 (Internal code=7). 

Event[3153]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T07:38:01.6450000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3154]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T07:38:18.9930000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\95a2fadd2b2c1627_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[3155]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-03T07:38:25.1100000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[3156]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T07:39:23.8710000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3157]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-03T07:54:28.8620000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[3158]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-03T07:54:35.0890000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.283.0) - Current Channel (Broad) 

Event[3159]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-03T07:54:48.7780000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.283.0) - Current Channel (Broad) 

Event[3160]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-03T07:57:46.2280000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[3161]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-03T08:22:18.8330000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[3162]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-03T08:22:18.9640000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[3163]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-03T08:34:06.2520000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[3164]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-03T08:39:38.8630000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[3165]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-03T08:50:29.9350000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[3166]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-03T08:56:42.8670000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[3167]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-03T09:13:46.8700000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[3168]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-03T09:30:50.8850000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[3169]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-03T09:34:22.3500000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[3170]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-03T09:34:30.1030000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[3171]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T09:34:30.4360000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3172]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T09:34:30.4400000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3173]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T09:34:41.7920000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3174]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T09:34:51.3960000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (Version 6.1, ?2019?-?02?-?11T22:09:19.000000000Z) unloaded successfully. 

Event[3175]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T09:34:51.4000000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3176]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T09:34:57.5110000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3177]
  Log Name: System
  Source: User32
  Date: 2025-10-03T09:35:25.1860000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the restart of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: restart
 Comment:  

Event[3178]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-03T09:35:25.8670000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[3179]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-03T09:35:25.9610000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[3180]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T09:35:26.1670000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[3181]
  Log Name: System
  Source: EventLog
  Date: 2025-10-03T09:35:26.2320000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[3182]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T09:35:26.2250000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[3183]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T09:35:26.2250000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[3184]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-03T09:35:26.2280000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[3185]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-03T09:35:26.2280000Z
  Event ID: 51057
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service stop is almost done.DHCP Context Ref count is 1 

Event[3186]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T09:35:26.2350000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[3187]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T09:35:26.2350000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[3188]
  Log Name: System
  Source: EventLog
  Date: 2025-10-03T09:35:40.6820000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[3189]
  Log Name: System
  Source: EventLog
  Date: 2025-10-03T09:35:40.6830000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[3190]
  Log Name: System
  Source: EventLog
  Date: 2025-10-03T09:35:40.6840000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[3191]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-03T09:35:26.4330000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[3192]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-03T09:35:26.4600000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[3193]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T09:35:26.6450000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Reboot 
Event Code: 0x0 
Reason: Kernel API 

Event[3194]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T09:35:27.1810000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[3195]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T09:35:27.1810000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[3196]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T09:35:28.9360000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[3197]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T09:35:29.1770000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?03T05:35:29.177906800Z. 

Event[3198]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T09:35:35.8930000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?03T05:35:35.500000000Z. 

Event[3199]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T09:35:35.8930000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?03T05:35:35.500000000Z. 

Loader time: ?2025?-?10?-?03T05:35:34.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[3200]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T09:35:35.8940000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[3201]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T09:35:35.8940000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[3202]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T09:35:35.8940000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[3203]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T09:35:35.8940000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[3204]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T09:35:35.8940000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[3205]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T09:35:35.8940000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?03T11:05:34.000000000Z. 

Event[3206]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T09:35:35.8940000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[3207]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T09:35:35.8940000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[3208]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T09:35:35.8980000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[3209]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T09:35:35.8980000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[3210]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-03T09:35:35.9420000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[3211]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-03T09:35:36.1050000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[3212]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T09:35:36.3320000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3213]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T09:35:36.3330000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3214]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T09:35:36.3340000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3215]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-03T09:35:36.7390000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[3216]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T09:35:36.8380000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3217]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T09:35:36.8430000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3218]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T09:35:36.9490000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3219]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T09:35:36.9810000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[3220]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T09:35:36.9810000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[3221]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T09:35:36.9830000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[3222]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-03T09:35:37.4680000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[3223]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T09:35:37.5110000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3224]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T09:35:37.5190000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3225]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-03T09:35:37.5340000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[3226]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-03T09:35:37.5360000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[3227]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T09:35:37.5380000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3228]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T09:35:37.5400000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3229]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T09:35:37.5440000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3230]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T09:35:37.5450000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3231]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T09:35:37.5460000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3232]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T09:35:37.6080000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3233]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T09:35:37.6130000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[3234]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T09:35:37.6670000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[3235]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-03T09:35:38.1590000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[3236]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-03T09:35:38.3070000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[3237]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T09:35:38.3750000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[3238]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-10-03T09:35:38.5960000Z
  Event ID: 10118
  Task: Startup of the UMDF reflector 
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
UMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts. 

Event[3239]
  Log Name: System
  Source: Microsoft-Windows-Kernel-PnP
  Date: 2025-10-03T09:35:38.5970000Z
  Event ID: 219
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The driver \Driver\WudfRd failed to load.
Device: USB\VID_05AC&PID_12A8&MI_00\6&302d0ec3&1&0000
Status: 0xC0000365 

Event[3240]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-03T09:35:39.0330000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[3241]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-03T09:35:39.0810000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[3242]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T09:35:39.1300000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[3243]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T09:35:39.1300000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[3244]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T09:35:39.1300000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[3245]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T09:35:39.1310000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[3246]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T09:35:39.2280000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[3247]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T09:35:39.2300000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[3248]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-03T09:35:39.2820000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[3249]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-03T09:35:39.4530000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[3250]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-03T09:35:39.4630000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[3251]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-03T09:35:39.4630000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[3252]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T09:35:40.4650000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3253]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T09:35:40.4750000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3254]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T09:35:40.4800000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3255]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T09:35:40.4900000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3256]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T09:35:40.5110000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3257]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T09:35:40.5110000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[3258]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T09:35:40.5110000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3259]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T09:35:40.5180000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3260]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T09:35:40.5250000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3261]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T09:35:40.5330000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3262]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T09:35:40.9480000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[3263]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T09:35:40.9480000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[3264]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T09:35:40.9480000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[3265]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-03T09:35:40.9780000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[3266]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-03T09:35:41.0480000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[3267]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T09:35:41.1900000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3268]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T09:35:41.1900000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3269]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T09:35:41.1900000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3270]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T09:35:41.1900000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3271]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T09:35:41.1900000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3272]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T09:35:41.1900000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3273]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T09:35:41.1900000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3274]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T09:35:41.1900000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3275]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T09:35:41.1900000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3276]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T09:35:41.1900000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3277]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T09:35:41.1900000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3278]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T09:35:41.1900000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3279]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T09:35:41.1900000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3280]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T09:35:41.1900000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3281]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T09:35:41.4800000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[3282]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T09:35:42.8000000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[3283]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T09:35:42.8000000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000028-0000000000.json for detailed information on what checks were made. 

Event[3284]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T09:35:43.2160000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[3285]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-03T09:35:43.3350000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[3286]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-03T09:35:43.3670000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[3287]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T09:35:43.8960000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3288]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T09:35:43.9000000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3289]
  Log Name: System
  Source: TPM
  Date: 2025-10-03T09:35:46.2290000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[3290]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T09:35:47.8750000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[3291]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T09:35:49.2610000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[3292]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T09:36:11.0600000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3293]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T09:36:18.3870000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3294]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T09:36:20.1760000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3295]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T09:36:48.6680000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3296]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T09:36:48.6860000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3297]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T09:36:48.7090000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3298]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T09:36:48.7090000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3299]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T09:36:48.7090000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3300]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T09:36:48.7090000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3301]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T09:36:48.7090000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3302]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T09:36:48.7090000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3303]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T09:37:45.0570000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3304]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T09:37:45.0580000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3305]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T09:37:45.0580000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3306]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-03T09:38:16.2280000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[3307]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T09:40:41.1400000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[3308]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T09:40:41.1400000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[3309]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-03T09:46:18.1430000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[3310]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-03T09:47:26.8780000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.284.0) - Current Channel (Broad) 

Event[3311]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-03T09:47:40.1370000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.284.0) - Current Channel (Broad) 

Event[3312]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T10:27:17.6290000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[3313]
  Log Name: System
  Source: EventLog
  Date: 2025-10-03T10:30:00.6860000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 3265 seconds. 

Event[3314]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-03T11:22:48.0840000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[3315]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-03T12:46:12.1900000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name t-s2-ring.msedge.net timed out after none of the configured DNS servers responded. Client PID 8864. 

Event[3316]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T12:46:54.7650000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[3317]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T12:58:27.5990000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[3318]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T12:58:41.7420000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[3319]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T13:02:26.1480000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[3320]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T13:38:51.5880000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Service for Realtek HD Audio (WDM) service was changed from demand start to disabled. 

Event[3321]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T13:39:00.7870000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  SetupARService
Service File Name:  "C:\Program Files (x86)\Realtek\Audio\SetupAfterRebootService.exe"
Service Type:  user mode service
Service Start Type:  auto start
Service Account:  LocalSystem 

Event[3322]
  Log Name: System
  Source: User32
  Date: 2025-10-03T13:42:58.2380000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the restart of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: restart
 Comment:  

Event[3323]
  Log Name: System
  Source: EventLog
  Date: 2025-10-03T13:42:59.9640000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[3324]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-03T13:42:59.3690000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[3325]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-03T13:42:59.4610000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[3326]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T13:42:59.8830000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[3327]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T13:42:59.9490000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[3328]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T13:42:59.9490000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[3329]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-03T13:42:59.9510000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[3330]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-03T13:42:59.9510000Z
  Event ID: 51057
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service stop is almost done.DHCP Context Ref count is 1 

Event[3331]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T13:42:59.9540000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[3332]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T13:42:59.9540000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[3333]
  Log Name: System
  Source: EventLog
  Date: 2025-10-03T13:43:14.7150000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[3334]
  Log Name: System
  Source: EventLog
  Date: 2025-10-03T13:43:14.7150000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[3335]
  Log Name: System
  Source: EventLog
  Date: 2025-10-03T13:43:14.7160000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[3336]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-03T13:43:00.1610000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[3337]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-03T13:43:00.1850000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[3338]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T13:43:00.4410000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Reboot 
Event Code: 0x0 
Reason: Kernel API 

Event[3339]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T13:43:00.8980000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[3340]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T13:43:00.8980000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[3341]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T13:43:02.7950000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[3342]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T13:43:03.1270000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?03T09:43:03.127366600Z. 

Event[3343]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T13:43:09.8500000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?03T09:43:09.500000000Z. 

Event[3344]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T13:43:09.8500000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?03T09:43:09.500000000Z. 

Loader time: ?2025?-?10?-?03T09:43:08.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[3345]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T13:43:09.8510000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[3346]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T13:43:09.8510000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[3347]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T13:43:09.8510000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[3348]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T13:43:09.8510000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[3349]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T13:43:09.8510000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[3350]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T13:43:09.8510000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?03T15:13:08.000000000Z. 

Event[3351]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T13:43:09.8510000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[3352]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T13:43:09.8510000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[3353]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T13:43:09.8550000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[3354]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T13:43:09.8550000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[3355]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-03T13:43:09.8900000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[3356]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-03T13:43:10.0530000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[3357]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:43:10.2740000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3358]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:43:10.2750000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3359]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:43:10.2770000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3360]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-03T13:43:10.7050000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[3361]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:43:10.8090000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3362]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:43:10.8140000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3363]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:43:10.9200000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3364]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T13:43:10.9540000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[3365]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T13:43:10.9540000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[3366]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T13:43:10.9560000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[3367]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-03T13:43:11.4420000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[3368]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:43:11.4810000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3369]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-03T13:43:11.5050000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[3370]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-03T13:43:11.5050000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[3371]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:43:11.5180000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3372]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:43:11.5190000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3373]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:43:11.5200000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3374]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:43:11.5210000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3375]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:43:11.5220000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3376]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:43:11.5230000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3377]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:43:11.6130000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3378]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T13:43:11.6170000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[3379]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T13:43:11.6840000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[3380]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-03T13:43:12.0640000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[3381]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-03T13:43:12.3000000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[3382]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T13:43:12.3690000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[3383]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-10-03T13:43:12.5640000Z
  Event ID: 10118
  Task: Startup of the UMDF reflector 
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
UMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts. 

Event[3384]
  Log Name: System
  Source: Microsoft-Windows-Kernel-PnP
  Date: 2025-10-03T13:43:12.5650000Z
  Event ID: 219
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The driver \Driver\WudfRd failed to load.
Device: USB\VID_05AC&PID_12A8&MI_00\6&302d0ec3&1&0000
Status: 0xC0000365 

Event[3385]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-03T13:43:13.0130000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[3386]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-03T13:43:13.0580000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[3387]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T13:43:13.1460000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[3388]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T13:43:13.1460000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[3389]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T13:43:13.1460000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[3390]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T13:43:13.1480000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[3391]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T13:43:13.2450000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[3392]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T13:43:13.2470000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[3393]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-03T13:43:13.2980000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[3394]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-03T13:43:13.4660000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[3395]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-03T13:43:13.4780000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[3396]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-03T13:43:13.4780000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[3397]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:43:14.4460000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3398]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:43:14.5020000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3399]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:43:14.5130000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3400]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:43:14.5320000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3401]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:43:14.5530000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3402]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:43:14.5530000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[3403]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:43:14.5530000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3404]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:43:14.5590000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3405]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:43:14.5680000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3406]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:43:14.5790000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3407]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T13:43:14.9210000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[3408]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T13:43:14.9220000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[3409]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T13:43:14.9220000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[3410]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-03T13:43:14.9440000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[3411]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-03T13:43:15.0840000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[3412]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:43:15.1490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3413]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:43:15.1490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3414]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:43:15.1490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3415]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:43:15.1490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3416]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:43:15.1490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3417]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:43:15.1490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3418]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:43:15.1490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3419]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:43:15.1490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3420]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:43:15.1490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3421]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:43:15.1490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3422]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:43:15.1490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3423]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:43:15.1490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3424]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:43:15.1490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3425]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:43:15.1490000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3426]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T13:43:15.4700000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[3427]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T13:43:16.7060000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[3428]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T13:43:16.7060000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000029-0000000000.json for detailed information on what checks were made. 

Event[3429]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T13:43:17.0790000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[3430]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-03T13:43:17.2330000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[3431]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-03T13:43:17.2660000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[3432]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T13:43:17.8000000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3433]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T13:43:17.8060000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3434]
  Log Name: System
  Source: TPM
  Date: 2025-10-03T13:43:20.1960000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[3435]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T13:43:21.7010000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[3436]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T13:43:23.3250000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[3437]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T13:43:41.9770000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3438]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:43:49.8470000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3439]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-03T13:44:04.8530000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume ?? (\Device\HarddiskVolumeShadowCopy4) is healthy.  No action is needed. 

Event[3440]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:44:22.6490000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3441]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:44:22.6810000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3442]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:44:22.6810000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3443]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:44:22.6810000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3444]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:44:22.6810000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3445]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:44:22.6810000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3446]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:44:22.6810000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3447]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:44:22.6970000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3448]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-03T13:44:33.8840000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[3449]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-03T13:44:36.3130000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[3450]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T13:44:48.7920000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  Service for Realtek HD Audio (WDM)
Service File Name:  \SystemRoot\system32\drivers\RTKVHD64.sys
Service Type:  kernel mode driver
Service Start Type:  demand start
Service Account:   

Event[3451]
  Log Name: System
  Source: Microsoft-Windows-UserPnp
  Date: 2025-10-03T13:44:48.8020000Z
  Event ID: 20003
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Driver Management has concluded the process to add Service IntcAzAudAddService for Device Instance ID HDAUDIO\FUNC_01&VEN_10EC&DEV_0235&SUBSYS_17AA3826&REV_1000\4&5FDE102&0&0001 with the following status: 0. 

Event[3452]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T13:44:54.3550000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  Realtek Audio Service
Service File Name:  "C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe"
Service Type:  user mode service
Service Start Type:  auto start
Service Account:  LocalSystem 

Event[3453]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T13:45:01.4980000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  Dolby DAX2 API Service
Service File Name:  "C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe"
Service Type:  user mode service
Service Start Type:  demand start
Service Account:  LocalSystem 

Event[3454]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T13:45:01.4980000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Dolby DAX2 API Service service was changed from demand start to auto start. 

Event[3455]
  Log Name: System
  Source: EventLog
  Date: 2025-10-03T13:45:12.6710000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[3456]
  Log Name: System
  Source: User32
  Date: 2025-10-03T13:45:12.0950000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The process C:\WINDOWS\system32\winlogon.exe (256GB-SSD) has initiated the restart of computer 256GB-SSD on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
 Reason Code: 0x500ff
 Shutdown Type: restart
 Comment:  

Event[3457]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-03T13:45:12.1030000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[3458]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-03T13:45:12.2630000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[3459]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T13:45:12.6000000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[3460]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T13:45:12.6660000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[3461]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T13:45:12.6660000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[3462]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-03T13:45:12.6690000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[3463]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-03T13:45:12.6690000Z
  Event ID: 51057
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service stop is almost done.DHCP Context Ref count is 1 

Event[3464]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T13:45:12.6760000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[3465]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T13:45:12.6760000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[3466]
  Log Name: System
  Source: EventLog
  Date: 2025-10-03T13:45:31.4630000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[3467]
  Log Name: System
  Source: EventLog
  Date: 2025-10-03T13:45:31.4640000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[3468]
  Log Name: System
  Source: EventLog
  Date: 2025-10-03T13:45:31.4650000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 4 seconds. 

Event[3469]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-03T13:45:12.8550000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[3470]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-03T13:45:12.9590000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[3471]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T13:45:13.6130000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[3472]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T13:45:13.6130000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[3473]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T13:45:17.6370000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Reboot 
Event Code: 0x0 
Reason: Kernel API 

Event[3474]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T13:45:18.8370000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[3475]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T13:45:19.8710000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?03T09:45:19.871159800Z. 

Event[3476]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T13:45:26.8920000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?03T09:45:26.500000000Z. 

Event[3477]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T13:45:26.8920000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?03T09:45:26.500000000Z. 

Loader time: ?2025?-?10?-?03T09:45:25.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[3478]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T13:45:26.8930000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[3479]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T13:45:26.8930000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[3480]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T13:45:26.8930000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[3481]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T13:45:26.8930000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[3482]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T13:45:26.8930000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[3483]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T13:45:26.8930000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?03T15:15:25.000000000Z. 

Event[3484]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T13:45:26.8930000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[3485]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T13:45:26.8930000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[3486]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T13:45:26.8970000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[3487]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T13:45:26.8970000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[3488]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-03T13:45:26.9280000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[3489]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-03T13:45:27.0910000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[3490]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:45:27.3030000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3491]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:45:27.3040000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3492]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:45:27.3050000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3493]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-03T13:45:27.6580000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[3494]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:45:27.7410000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3495]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:45:27.7460000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3496]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:45:27.8510000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3497]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T13:45:27.8850000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[3498]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T13:45:27.8850000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[3499]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T13:45:27.8860000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[3500]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-03T13:45:28.3760000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[3501]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:45:28.4190000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3502]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:45:28.4270000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3503]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:45:28.4360000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3504]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:45:28.4370000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3505]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-03T13:45:28.4420000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[3506]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-03T13:45:28.4420000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[3507]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:45:28.4450000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3508]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:45:28.4470000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3509]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:45:28.4480000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3510]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:45:28.4500000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3511]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T13:45:28.4540000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[3512]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T13:45:28.5340000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[3513]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-03T13:45:28.9500000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[3514]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-03T13:45:29.1210000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[3515]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T13:45:29.1820000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[3516]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-10-03T13:45:29.4460000Z
  Event ID: 10118
  Task: Startup of the UMDF reflector 
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
UMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts. 

Event[3517]
  Log Name: System
  Source: Microsoft-Windows-Kernel-PnP
  Date: 2025-10-03T13:45:29.4470000Z
  Event ID: 219
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The driver \Driver\WudfRd failed to load.
Device: USB\VID_05AC&PID_12A8&MI_00\6&302d0ec3&1&0000
Status: 0xC0000365 

Event[3518]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-03T13:45:29.7710000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[3519]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-03T13:45:29.8160000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[3520]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T13:45:29.9270000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[3521]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T13:45:29.9270000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[3522]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T13:45:29.9270000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[3523]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T13:45:29.9280000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[3524]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T13:45:30.0230000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[3525]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T13:45:30.0240000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[3526]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-03T13:45:30.0770000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[3527]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-03T13:45:30.2560000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[3528]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-03T13:45:30.2680000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[3529]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-03T13:45:30.2680000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[3530]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:45:31.2590000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3531]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:45:31.2770000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3532]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:45:31.2870000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3533]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:45:31.3050000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3534]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:45:31.3300000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3535]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:45:31.3300000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[3536]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:45:31.3310000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3537]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:45:31.3340000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3538]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:45:31.3480000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3539]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:45:31.3570000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3540]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T13:45:31.7510000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[3541]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T13:45:31.7510000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[3542]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T13:45:31.7510000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[3543]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-03T13:45:31.7750000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[3544]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:45:31.9960000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3545]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:45:31.9960000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3546]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:45:31.9960000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3547]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:45:31.9960000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3548]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:45:31.9960000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3549]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:45:31.9960000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3550]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:45:31.9960000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3551]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:45:31.9960000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3552]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:45:31.9960000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3553]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:45:31.9960000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3554]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:45:31.9960000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3555]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:45:31.9960000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3556]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:45:31.9960000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3557]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T13:45:31.9960000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3558]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T13:45:32.5460000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[3559]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T13:45:34.1550000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[3560]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T13:45:34.1550000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000030-0000000000.json for detailed information on what checks were made. 

Event[3561]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T13:45:34.2470000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[3562]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-03T13:45:34.3810000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[3563]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-03T13:45:34.4220000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[3564]
  Log Name: System
  Source: TPM
  Date: 2025-10-03T13:45:37.2170000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[3565]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T13:45:38.1480000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[3566]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T13:45:38.5970000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[3567]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-03T13:45:39.0140000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[3568]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T13:45:39.4440000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3569]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T13:45:39.4530000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3570]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T13:46:00.9290000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3571]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T13:46:10.1040000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3572]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:46:39.5880000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3573]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:46:39.5880000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3574]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:46:39.5880000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3575]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:46:39.6040000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3576]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:46:39.6040000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3577]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:46:39.6200000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3578]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:46:39.6200000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3579]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T13:46:39.6200000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3580]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T13:47:35.9250000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3581]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T13:47:35.9250000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3582]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T13:47:35.9270000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3583]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T13:47:42.4240000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3584]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-03T13:48:08.7260000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[3585]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T13:50:32.1120000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[3586]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T13:50:32.1120000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[3587]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T13:50:42.8510000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[3588]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T13:52:50.7720000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[3589]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-03T13:55:55.5520000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[3590]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-03T13:58:11.1460000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.291.0) - Current Channel (Broad) 

Event[3591]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-03T13:58:25.4630000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.291.0) - Current Channel (Broad) 

Event[3592]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-03T14:11:40.9790000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name t-s2-ring.msedge.net timed out after none of the configured DNS servers responded. Client PID 9064. 

Event[3593]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T14:18:32.5510000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[3594]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-03T15:18:34.7560000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[3595]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-03T15:40:23.3860000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[3596]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-03T15:46:52.0420000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name ib.adnxs.com timed out after none of the configured DNS servers responded. Client PID 3492. 

Event[3597]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T15:47:24.2180000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[3598]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T15:52:44.8130000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[3599]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T15:55:21.0700000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[3600]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T15:57:57.8320000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[3601]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T15:59:42.7210000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[3602]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T16:02:10.9560000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[3603]
  Log Name: System
  Source: User32
  Date: 2025-10-03T16:07:34.9180000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[3604]
  Log Name: System
  Source: EventLog
  Date: 2025-10-03T16:07:36.5630000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[3605]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-03T16:07:36.1240000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[3606]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-03T16:07:36.2090000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[3607]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T16:07:36.4980000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[3608]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T16:07:36.5510000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[3609]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T16:07:36.5520000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[3610]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-03T16:07:36.5540000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[3611]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T16:07:36.5580000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[3612]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T16:07:36.5580000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[3613]
  Log Name: System
  Source: EventLog
  Date: 2025-10-03T16:08:09.1780000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[3614]
  Log Name: System
  Source: EventLog
  Date: 2025-10-03T16:08:09.1790000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[3615]
  Log Name: System
  Source: EventLog
  Date: 2025-10-03T16:08:09.1800000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[3616]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-03T16:07:36.7510000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[3617]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-03T16:07:36.7730000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[3618]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T16:07:37.4990000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[3619]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T16:07:37.4990000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[3620]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T16:07:38.8480000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[3621]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T16:07:41.1830000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[3622]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T16:07:41.4090000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?03T12:07:41.409026300Z. 

Event[3623]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T16:08:03.8930000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?03T12:08:03.500000000Z. 

Event[3624]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T16:08:03.8930000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?03T12:08:03.500000000Z. 

Loader time: ?2025?-?10?-?03T12:08:03.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[3625]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T16:08:03.8940000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[3626]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T16:08:03.8940000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[3627]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T16:08:03.8940000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[3628]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T16:08:03.8940000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[3629]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T16:08:03.8940000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[3630]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T16:08:03.8940000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?03T17:38:03.000000000Z. 

Event[3631]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T16:08:03.8940000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[3632]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T16:08:03.8940000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[3633]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T16:08:03.8980000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[3634]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T16:08:03.8980000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[3635]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-03T16:08:03.9540000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[3636]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-03T16:08:04.1190000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[3637]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:08:04.3420000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3638]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:08:04.3430000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3639]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:08:04.3440000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3640]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-03T16:08:04.7870000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[3641]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:08:04.8960000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3642]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:08:04.9010000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3643]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:08:05.0530000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3644]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T16:08:05.0970000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[3645]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T16:08:05.0970000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[3646]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T16:08:05.1000000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[3647]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-03T16:08:05.7290000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[3648]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:08:05.7690000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3649]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:08:05.7790000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3650]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-03T16:08:05.7950000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[3651]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-03T16:08:05.7950000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[3652]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:08:05.7990000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3653]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:08:05.8030000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3654]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:08:05.8050000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3655]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:08:05.8060000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3656]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:08:05.8070000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3657]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:08:05.8090000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3658]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T16:08:05.8130000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[3659]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T16:08:05.8770000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[3660]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-03T16:08:06.4280000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[3661]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-03T16:08:06.6320000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[3662]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T16:08:06.7060000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[3663]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-03T16:08:07.5890000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[3664]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T16:08:07.6180000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[3665]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T16:08:07.6180000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[3666]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T16:08:07.6180000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[3667]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T16:08:07.6190000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[3668]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-03T16:08:07.6360000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[3669]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T16:08:07.7330000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[3670]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T16:08:07.7340000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[3671]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-03T16:08:07.8020000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[3672]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-03T16:08:07.9910000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[3673]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-03T16:08:08.0030000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[3674]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-03T16:08:08.0030000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[3675]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:08:08.9820000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3676]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:08:08.9940000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3677]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:08:08.9990000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3678]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:08:09.0080000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3679]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:08:09.0290000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3680]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:08:09.0290000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[3681]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:08:09.0290000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3682]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:08:09.0340000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3683]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:08:09.0430000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3684]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:08:09.0530000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3685]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T16:08:09.4490000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[3686]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T16:08:09.4490000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[3687]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T16:08:09.4500000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[3688]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-03T16:08:09.4830000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[3689]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-03T16:08:09.6180000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[3690]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:08:09.6790000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3691]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:08:09.6790000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3692]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:08:09.6790000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3693]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:08:09.6790000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3694]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:08:09.6790000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3695]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:08:09.6790000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3696]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:08:09.6790000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3697]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:08:09.6790000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3698]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:08:09.6790000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3699]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:08:09.6790000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3700]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:08:09.6790000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3701]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:08:09.6790000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3702]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:08:09.6790000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3703]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:08:09.6790000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3704]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T16:08:10.0710000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[3705]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T16:08:11.5130000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[3706]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T16:08:11.5130000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000031-0000000000.json for detailed information on what checks were made. 

Event[3707]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T16:08:11.7910000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[3708]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-03T16:08:11.9060000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[3709]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-03T16:08:11.9390000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[3710]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T16:08:12.4550000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3711]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T16:08:12.4630000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3712]
  Log Name: System
  Source: TPM
  Date: 2025-10-03T16:08:14.2410000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[3713]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T16:08:15.5230000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[3714]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T16:08:16.4260000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[3715]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T16:08:32.9660000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3716]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:08:41.9240000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3717]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-03T16:09:15.9560000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name tracker.openbittorrent.com timed out after none of the configured DNS servers responded. Client PID 11660. 

Event[3718]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:09:16.9270000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3719]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:09:16.9430000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3720]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:09:16.9590000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3721]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:09:16.9590000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3722]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:09:16.9740000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3723]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:09:16.9740000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3724]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:09:16.9740000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3725]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:09:16.9740000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3726]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T16:10:13.2020000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3727]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T16:10:13.2040000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3728]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T16:10:13.2040000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3729]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-03T16:12:17.7130000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[3730]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T16:13:09.6370000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[3731]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T16:13:09.6370000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[3732]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T16:18:26.3740000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[3733]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-03T16:18:32.4540000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[3734]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-03T16:25:51.5530000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.292.0) - Current Channel (Broad) 

Event[3735]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-03T16:26:03.2790000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.292.0) - Current Channel (Broad) 

Event[3736]
  Log Name: System
  Source: User32
  Date: 2025-10-03T16:26:33.9590000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The process C:\WINDOWS\system32\winlogon.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title for this reason could be found
 Reason Code: 0x500ff
 Shutdown Type: power off
 Comment:  

Event[3737]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-03T16:26:33.9620000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[3738]
  Log Name: System
  Source: EventLog
  Date: 2025-10-03T16:26:35.5390000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[3739]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-03T16:26:35.1830000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[3740]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T16:26:35.4620000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[3741]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T16:26:35.5260000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[3742]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T16:26:35.5260000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[3743]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T16:26:35.5280000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[3744]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-03T16:26:35.5280000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[3745]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-03T16:26:35.5280000Z
  Event ID: 51057
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service stop is almost done.DHCP Context Ref count is 1 

Event[3746]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T16:26:35.5290000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[3747]
  Log Name: System
  Source: EventLog
  Date: 2025-10-03T16:30:03.1980000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[3748]
  Log Name: System
  Source: EventLog
  Date: 2025-10-03T16:30:03.1990000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[3749]
  Log Name: System
  Source: EventLog
  Date: 2025-10-03T16:30:03.2000000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[3750]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-03T16:26:35.7430000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[3751]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-03T16:26:35.7800000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[3752]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T16:26:36.0350000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[3753]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T16:26:36.4780000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[3754]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T16:26:36.4780000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[3755]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T16:26:37.8490000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[3756]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T16:26:38.0220000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?03T12:26:38.022974800Z. 

Event[3757]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T16:29:57.8920000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?03T12:29:57.500000000Z. 

Event[3758]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T16:29:57.8920000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?03T12:29:57.500000000Z. 

Loader time: ?2025?-?10?-?03T12:29:57.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[3759]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T16:29:57.8920000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[3760]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T16:29:57.8920000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[3761]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T16:29:57.8920000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[3762]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T16:29:57.8920000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[3763]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T16:29:57.8920000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[3764]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T16:29:57.8930000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?03T17:59:57.000000000Z. 

Event[3765]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T16:29:57.8930000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[3766]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T16:29:57.8930000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[3767]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-03T16:29:57.8960000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[3768]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T16:29:57.8970000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[3769]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-03T16:29:57.9350000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[3770]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-03T16:29:58.1000000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[3771]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:29:58.3200000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3772]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:29:58.3210000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3773]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:29:58.3220000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3774]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-03T16:29:58.7650000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[3775]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:29:58.8740000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3776]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:29:58.8790000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3777]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:29:59.0340000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3778]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T16:29:59.0820000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[3779]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T16:29:59.0820000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[3780]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T16:29:59.0850000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[3781]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-03T16:29:59.7520000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[3782]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:29:59.7950000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3783]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:29:59.8040000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3784]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:29:59.8050000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3785]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:29:59.8110000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3786]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:29:59.8130000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3787]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:29:59.8170000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3788]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:29:59.8180000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3789]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-03T16:29:59.8200000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[3790]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-03T16:29:59.8200000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[3791]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:29:59.8350000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3792]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T16:29:59.8620000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[3793]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T16:29:59.9350000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[3794]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-03T16:30:00.4590000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[3795]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-03T16:30:00.6630000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[3796]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T16:30:00.7460000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[3797]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-10-03T16:30:00.7590000Z
  Event ID: 10118
  Task: Startup of the UMDF reflector 
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
UMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts. 

Event[3798]
  Log Name: System
  Source: Microsoft-Windows-Kernel-PnP
  Date: 2025-10-03T16:30:00.7600000Z
  Event ID: 219
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The driver \Driver\WudfRd failed to load.
Device: USB\VID_05AC&PID_12A8&MI_00\6&302d0ec3&1&0000
Status: 0xC0000365 

Event[3799]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T16:30:01.6010000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[3800]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T16:30:01.6010000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[3801]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T16:30:01.6010000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[3802]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T16:30:01.6020000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[3803]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T16:30:01.6960000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[3804]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-03T16:30:01.6970000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[3805]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-03T16:30:01.6950000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[3806]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-03T16:30:01.7460000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[3807]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-03T16:30:01.7510000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[3808]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-03T16:30:01.9460000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[3809]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-03T16:30:01.9580000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[3810]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-03T16:30:01.9580000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[3811]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:30:02.9440000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3812]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:30:02.9790000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3813]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:30:02.9930000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3814]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:30:03.0080000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3815]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:30:03.0300000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3816]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:30:03.0300000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[3817]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:30:03.0300000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3818]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:30:03.0350000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3819]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:30:03.0520000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3820]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:30:03.0610000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3821]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T16:30:03.4350000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[3822]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T16:30:03.4350000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[3823]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T16:30:03.4350000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[3824]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-03T16:30:03.4550000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[3825]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:30:03.6250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3826]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:30:03.6250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3827]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:30:03.6250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3828]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:30:03.6250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3829]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:30:03.6250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3830]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:30:03.6250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3831]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:30:03.6250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3832]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:30:03.6250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3833]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:30:03.6250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3834]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:30:03.6250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3835]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:30:03.6250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3836]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:30:03.6250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3837]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:30:03.6250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3838]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-03T16:30:03.6250000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3839]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T16:30:04.0400000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[3840]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T16:30:05.3300000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[3841]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T16:30:05.3300000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000032-0000000000.json for detailed information on what checks were made. 

Event[3842]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T16:30:05.8230000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[3843]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-03T16:30:05.9680000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[3844]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-03T16:30:06.0010000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[3845]
  Log Name: System
  Source: TPM
  Date: 2025-10-03T16:30:08.2190000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[3846]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T16:30:08.9940000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[3847]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T16:30:09.4410000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[3848]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-03T16:30:11.2770000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[3849]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T16:30:11.7540000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3850]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T16:30:11.7580000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3851]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T16:30:32.1710000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3852]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-03T16:30:37.5110000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3853]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:31:10.9640000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3854]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:31:10.9640000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3855]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:31:10.9640000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3856]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:31:10.9640000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3857]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:31:10.9800000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3858]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:31:10.9800000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3859]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:31:10.9800000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3860]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-03T16:31:10.9800000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3861]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T16:32:07.5880000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3862]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T16:32:07.5880000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3863]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T16:32:07.5880000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3864]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-03T16:32:40.6220000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[3865]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T16:35:03.6460000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[3866]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-03T16:35:03.6460000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[3867]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-03T16:35:08.6840000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3868]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T16:55:15.5200000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[3869]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-03T16:55:18.8270000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[3870]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T16:56:37.6320000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[3871]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T16:58:41.8070000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[3872]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-03T17:53:06.0130000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[3873]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-03T18:09:18.2610000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[3874]
  Log Name: System
  Source: Tcpip
  Date: 2025-10-03T18:49:55.2110000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[3875]
  Log Name: System
  Source: User32
  Date: 2025-10-03T18:54:41.8270000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[3876]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-03T18:54:42.8250000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[3877]
  Log Name: System
  Source: EventLog
  Date: 2025-10-03T18:54:43.3310000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[3878]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-03T18:54:42.9710000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[3879]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T18:54:43.2660000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[3880]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T18:54:43.3210000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[3881]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T18:54:43.3220000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[3882]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T18:54:43.3260000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[3883]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-03T18:54:43.3270000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[3884]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-03T18:54:43.3270000Z
  Event ID: 51057
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service stop is almost done.DHCP Context Ref count is 1 

Event[3885]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-03T18:54:43.3380000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[3886]
  Log Name: System
  Source: EventLog
  Date: 2025-10-04T07:44:37.4280000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[3887]
  Log Name: System
  Source: EventLog
  Date: 2025-10-04T07:44:37.4290000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[3888]
  Log Name: System
  Source: EventLog
  Date: 2025-10-04T07:44:37.4300000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[3889]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-03T18:54:43.5500000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[3890]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-03T18:54:43.5700000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[3891]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T18:54:43.7590000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[3892]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T18:54:44.2770000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[3893]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-03T18:54:44.2770000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[3894]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-03T18:54:46.3390000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[3895]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-03T18:54:46.5110000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?03T14:54:46.511933300Z. 

Event[3896]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-04T07:44:31.9050000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?04T03:44:31.500000000Z. 

Event[3897]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-04T07:44:31.9050000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?04T03:44:31.500000000Z. 

Loader time: ?2025?-?10?-?04T03:44:31.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[3898]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-04T07:44:31.9050000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[3899]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-04T07:44:31.9050000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[3900]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-04T07:44:31.9050000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[3901]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-04T07:44:31.9050000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[3902]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-04T07:44:31.9050000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[3903]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-04T07:44:31.9050000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?04T09:14:31.000000000Z. 

Event[3904]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-04T07:44:31.9050000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[3905]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-04T07:44:31.9050000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[3906]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-04T07:44:31.9090000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[3907]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-04T07:44:31.9090000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[3908]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-04T07:44:31.9500000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[3909]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-04T07:44:32.1010000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[3910]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-04T07:44:32.3180000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3911]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-04T07:44:32.3190000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3912]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-04T07:44:32.3210000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3913]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-04T07:44:32.7940000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[3914]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-04T07:44:32.9240000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3915]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-04T07:44:32.9290000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3916]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-04T07:44:33.1240000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3917]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-04T07:44:33.1780000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[3918]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-04T07:44:33.1780000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[3919]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-04T07:44:33.1830000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[3920]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-04T07:44:33.8960000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[3921]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-04T07:44:33.9380000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3922]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-04T07:44:33.9630000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[3923]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-04T07:44:33.9650000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[3924]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-04T07:44:33.9680000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3925]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-04T07:44:33.9690000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3926]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-04T07:44:33.9700000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3927]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-04T07:44:33.9710000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3928]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-04T07:44:33.9720000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3929]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-04T07:44:33.9740000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3930]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-04T07:44:33.9750000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[3931]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-04T07:44:33.9800000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[3932]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-04T07:44:34.0340000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[3933]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-04T07:44:34.7140000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[3934]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-04T07:44:34.9330000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[3935]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-04T07:44:35.0140000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[3936]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-04T07:44:35.7850000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[3937]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-04T07:44:35.8240000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[3938]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-04T07:44:35.8630000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[3939]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-04T07:44:35.8630000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[3940]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-04T07:44:35.8630000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[3941]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-04T07:44:35.8650000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[3942]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-04T07:44:35.9700000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[3943]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-04T07:44:35.9720000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[3944]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-04T07:44:36.0240000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[3945]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-04T07:44:36.2160000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[3946]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-04T07:44:36.2280000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[3947]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-04T07:44:36.2280000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[3948]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-04T07:44:37.2210000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3949]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-04T07:44:37.2320000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3950]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-04T07:44:37.2420000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3951]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-04T07:44:37.2570000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3952]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-04T07:44:37.2850000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3953]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-04T07:44:37.2850000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3954]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-04T07:44:37.2850000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[3955]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-04T07:44:37.2850000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3956]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-04T07:44:37.2950000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3957]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-04T07:44:37.3120000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3958]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-04T07:44:37.7470000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[3959]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-04T07:44:37.7470000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[3960]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-04T07:44:37.7470000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[3961]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-04T07:44:37.7680000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[3962]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-04T07:44:37.8710000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[3963]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-04T07:44:37.9320000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3964]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-04T07:44:37.9320000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3965]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-04T07:44:37.9320000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3966]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-04T07:44:37.9320000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3967]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-04T07:44:37.9320000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3968]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-04T07:44:37.9320000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3969]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-04T07:44:37.9320000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3970]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-04T07:44:37.9320000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3971]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-04T07:44:37.9330000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3972]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-04T07:44:37.9330000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3973]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-04T07:44:37.9330000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3974]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-04T07:44:37.9330000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3975]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-04T07:44:37.9330000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3976]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-04T07:44:37.9330000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[3977]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T07:44:38.3000000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[3978]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-04T07:44:39.8910000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[3979]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-04T07:44:39.8910000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000033-0000000000.json for detailed information on what checks were made. 

Event[3980]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T07:44:40.0100000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[3981]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-04T07:44:40.1330000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[3982]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-04T07:44:40.1660000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[3983]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-04T07:44:40.6770000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3984]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-04T07:44:40.6830000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3985]
  Log Name: System
  Source: TPM
  Date: 2025-10-04T07:44:42.2360000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[3986]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-04T07:44:43.9120000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[3987]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-04T07:44:45.7830000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[3988]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-04T07:45:01.3260000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3989]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-04T07:45:45.1090000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3990]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-04T07:45:45.1250000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3991]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-04T07:45:45.1250000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3992]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-04T07:45:45.1250000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3993]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-04T07:45:45.1250000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3994]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-04T07:45:45.1410000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3995]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-04T07:45:45.1410000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3996]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-04T07:45:45.1410000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[3997]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-04T07:46:02.6200000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[3998]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-04T07:46:41.0110000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[3999]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-04T07:46:41.0110000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4000]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-04T07:46:44.1560000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[4001]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-04T07:47:13.5160000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name 9.rarbg.me timed out after none of the configured DNS servers responded. Client PID 11692. 

Event[4002]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-04T07:49:37.9460000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[4003]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-04T07:49:37.9460000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[4004]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-04T07:53:24.0800000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4005]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-04T07:55:15.8230000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[4006]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-04T07:55:18.9190000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[4007]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-04T07:55:26.2490000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.307.0) - Current Channel (Broad) 

Event[4008]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-04T07:55:48.0460000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.307.0) - Current Channel (Broad) 

Event[4009]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-04T07:55:50.1270000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[4010]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T07:56:42.3540000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4011]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T08:00:35.1930000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4012]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T08:03:21.8900000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4013]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-04T08:17:03.2980000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[4014]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-04T08:17:03.9230000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[4015]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-04T08:17:04.0660000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[4016]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T08:17:23.8780000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4017]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T08:22:49.1020000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4018]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-04T08:23:17.9260000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[4019]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-04T08:34:23.9510000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[4020]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T08:36:55.3650000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4021]
  Log Name: System
  Source: Tcpip
  Date: 2025-10-04T08:39:02.2140000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[4022]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-04T08:51:27.9690000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[4023]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-04T09:00:49.0060000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[4024]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-04T09:04:43.6450000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 2 keys and creating 1 modified pages. 

Event[4025]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-04T09:08:31.9920000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[4026]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-04T09:21:52.3290000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[4027]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-04T09:25:36.0160000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[4028]
  Log Name: System
  Source: EventLog
  Date: 2025-10-04T10:30:00.4310000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 9928 seconds. 

Event[4029]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-04T12:50:08.0090000Z
  Event ID: 134
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on 'time.windows.com,0x9'. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: No such host is known. (0x80072AF9) 

Event[4030]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-04T13:38:19.8630000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[4031]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-04T13:38:54.4350000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4032]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-04T13:39:01.5390000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[4033]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-04T13:39:04.6880000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[4034]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-04T13:39:04.6880000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?04T09:39:04.687850300Z from ?2025?-?10?-?04T09:39:01.549238000Z.
Time Delta: 3138 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 13656).

RTC time: ?2025?-?10?-?04T15:09:04.687850300Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[4035]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-04T13:39:04.6880000Z
  Event ID: 35
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time service is now synchronizing the system time with the time source time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123) with reference id 3611644667. Current local stratum number is 4. 

Event[4036]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-04T13:39:04.6880000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[4037]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-04T13:39:04.6880000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?04T09:39:04.688611100Z from ?2025?-?10?-?04T09:39:04.688470100Z.
Time Delta: 0 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 13656).

RTC time: ?2025?-?10?-?04T15:09:04.688611100Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[4038]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-04T13:39:04.6900000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[4039]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-04T13:39:04.6900000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?04T09:39:04.690122200Z from ?2025?-?10?-?04T09:39:04.689457000Z.
Time Delta: 0 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 13656).

RTC time: ?2025?-?10?-?04T15:09:04.690122200Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[4040]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-04T13:39:30.3690000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[4041]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-04T13:40:40.9960000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsStore_22508.1401.7.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[4042]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-04T13:40:51.3030000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume ?? (\Device\HarddiskVolumeShadowCopy5) is healthy.  No action is needed. 

Event[4043]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-04T13:40:51.5120000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: 9WZDNCRFJBMP-MICROSOFT.WINDOWSSTORE 

Event[4044]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-04T13:40:59.5020000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: 9WZDNCRFJBMP-MICROSOFT.WINDOWSSTORE 

Event[4045]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T14:44:55.3020000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4046]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-04T14:45:01.1990000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4047]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T14:53:10.4590000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4048]
  Log Name: System
  Source: Tcpip
  Date: 2025-10-04T15:03:57.3610000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[4049]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T15:37:55.6460000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4050]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T15:40:02.1890000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4051]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T15:47:50.6940000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4052]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T15:50:27.6350000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4053]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T15:56:31.2870000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4054]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-04T15:57:44.6300000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[4055]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T15:58:59.5060000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4056]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-04T16:04:19.4100000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[4057]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T16:05:31.8250000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4058]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T16:07:56.1030000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4059]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T16:14:52.5710000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4060]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T16:17:08.7660000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4061]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T16:24:21.5560000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4062]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T16:26:49.8060000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4063]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-04T16:55:41.5410000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[4064]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T18:25:07.5930000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4065]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T18:27:11.8210000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4066]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-04T19:49:37.9090000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[4067]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-04T19:49:37.9090000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[4068]
  Log Name: System
  Source: User32
  Date: 2025-10-04T20:06:31.9630000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[4069]
  Log Name: System
  Source: EventLog
  Date: 2025-10-04T20:06:33.5820000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[4070]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-04T20:06:32.9940000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[4071]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-04T20:06:33.0700000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[4072]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T20:06:33.5210000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[4073]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-04T20:06:33.5670000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[4074]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-04T20:06:33.5670000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[4075]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-04T20:06:33.5690000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[4076]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-04T20:06:33.5700000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[4077]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-04T20:06:33.5820000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[4078]
  Log Name: System
  Source: EventLog
  Date: 2025-10-05T07:34:51.1960000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[4079]
  Log Name: System
  Source: EventLog
  Date: 2025-10-05T07:34:51.1970000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[4080]
  Log Name: System
  Source: EventLog
  Date: 2025-10-05T07:34:51.1980000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[4081]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-04T20:06:33.7990000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[4082]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-04T20:06:33.8340000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[4083]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-04T20:06:34.0320000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[4084]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T20:06:34.5330000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[4085]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-04T20:06:34.5330000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[4086]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-04T20:06:36.5030000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[4087]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-04T20:06:36.8100000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?04T16:06:36.810513000Z. 

Event[4088]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-05T07:34:45.8990000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?05T03:34:45.500000000Z. 

Event[4089]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-05T07:34:45.8990000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?05T03:34:45.500000000Z. 

Loader time: ?2025?-?10?-?05T03:34:45.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[4090]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-05T07:34:45.9000000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[4091]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-05T07:34:45.9000000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[4092]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-05T07:34:45.9000000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[4093]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-05T07:34:45.9000000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[4094]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-05T07:34:45.9000000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[4095]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-05T07:34:45.9000000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?05T09:04:45.000000000Z. 

Event[4096]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-05T07:34:45.9000000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[4097]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-05T07:34:45.9000000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[4098]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-05T07:34:45.9040000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[4099]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-05T07:34:45.9040000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[4100]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-05T07:34:45.9350000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[4101]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-05T07:34:46.0850000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[4102]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-05T07:34:46.3030000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4103]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-05T07:34:46.3040000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4104]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-05T07:34:46.3060000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4105]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-05T07:34:46.7740000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[4106]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-05T07:34:46.9750000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4107]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-05T07:34:46.9910000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4108]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-05T07:34:47.2020000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4109]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-05T07:34:47.2600000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[4110]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-05T07:34:47.2600000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[4111]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-05T07:34:47.2630000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[4112]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-05T07:34:48.1180000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[4113]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-05T07:34:48.1690000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4114]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-05T07:34:48.1780000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4115]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-05T07:34:48.1790000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4116]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-05T07:34:48.1810000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4117]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-05T07:34:48.1810000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[4118]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-05T07:34:48.1830000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[4119]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-05T07:34:48.1860000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4120]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-05T07:34:48.1870000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4121]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-05T07:34:48.1890000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4122]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-05T07:34:48.2730000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4123]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-05T07:34:48.2770000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[4124]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-05T07:34:48.3560000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[4125]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-05T07:34:48.9910000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[4126]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-05T07:34:49.2070000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[4127]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-05T07:34:49.2740000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[4128]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-10-05T07:34:49.4700000Z
  Event ID: 10118
  Task: Startup of the UMDF reflector 
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
UMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts. 

Event[4129]
  Log Name: System
  Source: Microsoft-Windows-Kernel-PnP
  Date: 2025-10-05T07:34:49.4710000Z
  Event ID: 219
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The driver \Driver\WudfRd failed to load.
Device: USB\VID_05AC&PID_12A8&MI_00\6&302d0ec3&1&0000
Status: 0xC0000365 

Event[4130]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-05T07:34:50.1780000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[4131]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-05T07:34:50.1780000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[4132]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-05T07:34:50.1780000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[4133]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-05T07:34:50.1790000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[4134]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-05T07:34:50.2860000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[4135]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-05T07:34:50.2880000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[4136]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-05T07:34:50.3420000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[4137]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-05T07:34:50.5330000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[4138]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-05T07:34:50.5430000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[4139]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-05T07:34:50.5430000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[4140]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-05T07:34:51.0070000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4141]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-05T07:34:51.0270000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4142]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-05T07:34:51.0380000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4143]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-05T07:34:51.0550000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4144]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-05T07:34:51.0740000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4145]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-05T07:34:51.0740000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[4146]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-05T07:34:51.0740000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4147]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-05T07:34:51.0800000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4148]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-05T07:34:51.0910000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4149]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-05T07:34:51.1000000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4150]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-05T07:34:51.5090000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[4151]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-05T07:34:51.5090000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[4152]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-05T07:34:51.5100000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[4153]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-05T07:34:51.5280000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[4154]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-05T07:34:51.6500000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[4155]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-05T07:34:51.7210000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4156]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-05T07:34:51.7210000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4157]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-05T07:34:51.7210000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4158]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-05T07:34:51.7210000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4159]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-05T07:34:51.7210000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4160]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-05T07:34:51.7210000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4161]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-05T07:34:51.7210000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4162]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-05T07:34:51.7210000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4163]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-05T07:34:51.7210000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4164]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-05T07:34:51.7210000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4165]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-05T07:34:51.7210000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4166]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-05T07:34:51.7210000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4167]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-05T07:34:51.7210000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4168]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-05T07:34:51.7210000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4169]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-05T07:34:52.0280000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[4170]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-05T07:34:53.4530000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[4171]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-05T07:34:53.4530000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000034-0000000000.json for detailed information on what checks were made. 

Event[4172]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-05T07:34:53.7580000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[4173]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-05T07:34:53.8830000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[4174]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-05T07:34:53.9190000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[4175]
  Log Name: System
  Source: TPM
  Date: 2025-10-05T07:34:56.2120000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[4176]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-05T07:34:57.5110000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[4177]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-05T07:34:57.6610000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4178]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-05T07:34:59.4920000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[4179]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-05T07:35:16.4940000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4180]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-05T07:35:22.8120000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4181]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-05T07:35:59.3350000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4182]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-05T07:35:59.3350000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4183]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-05T07:35:59.3410000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name edge.microsoft.com timed out after none of the configured DNS servers responded. Client PID 8644. 

Event[4184]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-05T07:35:59.3510000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4185]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-05T07:35:59.3510000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4186]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-05T07:35:59.3510000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4187]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-05T07:35:59.3510000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4188]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-05T07:35:59.3510000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4189]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-05T07:35:59.3510000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4190]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-05T07:36:12.1520000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4191]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-05T07:36:12.1520000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4192]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-05T07:36:12.1520000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4193]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-05T07:36:12.1590000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4194]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-05T07:36:55.0510000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4195]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-05T07:36:55.0510000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4196]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-05T07:37:02.4250000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4197]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-05T07:37:26.7700000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[4198]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-05T07:39:51.6390000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[4199]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-05T07:39:51.6390000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[4200]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-05T07:41:13.2560000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4201]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-05T07:46:27.8640000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[4202]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-05T07:46:33.2100000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[4203]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-05T07:46:44.8230000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.331.0) - Current Channel (Broad) 

Event[4204]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-05T07:46:59.9860000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.331.0) - Current Channel (Broad) 

Event[4205]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-05T07:56:56.6310000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[4206]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-05T08:04:31.7370000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[4207]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-05T08:05:31.9960000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[4208]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-05T08:05:32.1420000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[4209]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-05T08:22:52.0210000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[4210]
  Log Name: System
  Source: Tcpip
  Date: 2025-10-05T08:27:19.2230000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[4211]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-05T08:39:56.0400000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[4212]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-05T08:57:00.0670000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[4213]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-05T08:57:54.9210000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4214]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-05T09:02:33.1370000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[4215]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-05T09:14:04.0830000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[4216]
  Log Name: System
  Source: EventLog
  Date: 2025-10-05T10:30:00.2080000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 10514 seconds. 

Event[4217]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-05T11:26:32.1880000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[4218]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-05T11:46:45.0820000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name hy.outrunmost.com timed out after none of the configured DNS servers responded. Client PID 10924. 

Event[4219]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-05T12:38:36.2410000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[4220]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-05T12:38:53.4960000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[4221]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-05T12:38:53.4960000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?05T08:38:53.496539200Z from ?2025?-?10?-?05T08:38:52.248682000Z.
Time Delta: 1247 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 6812).

RTC time: ?2025?-?10?-?05T14:08:53.496539200Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[4222]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-05T12:38:53.4970000Z
  Event ID: 35
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time service is now synchronizing the system time with the time source time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123) with reference id 3611644667. Current local stratum number is 4. 

Event[4223]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-05T12:38:53.4970000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[4224]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-05T12:38:53.4970000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?05T08:38:53.497385700Z from ?2025?-?10?-?05T08:38:53.496539200Z.
Time Delta: 0 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 6812).

RTC time: ?2025?-?10?-?05T14:08:53.497385700Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[4225]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-05T12:38:53.4980000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[4226]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-05T12:38:53.4980000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?05T08:38:53.498562000Z from ?2025?-?10?-?05T08:38:53.497648800Z.
Time Delta: 0 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 6812).

RTC time: ?2025?-?10?-?05T14:08:53.498562000Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[4227]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-05T13:21:37.5400000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name i-29.b-47178.ut.bench.utorrent.com timed out after none of the configured DNS servers responded. Client PID 10104. 

Event[4228]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-05T13:26:19.9520000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[4229]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-05T14:10:00.6680000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name i-38.b-47178.ut.bench.utorrent.com timed out after none of the configured DNS servers responded. Client PID 10104. 

Event[4230]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-05T14:47:15.7000000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\93bd85b35cc104b1_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[4231]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-05T14:47:15.9220000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\DropboxInc.Dropbox_wkt425jdc3sga\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\124e7876dd58721b_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[4232]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-05T14:47:45.7340000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name i-38.b-47178.ut.bench.utorrent.com timed out after none of the configured DNS servers responded. Client PID 10104. 

Event[4233]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-05T15:10:45.3060000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 2 keys and creating 1 modified pages. 

Event[4234]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-05T16:00:41.0480000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.OfficePushNotificationUtility_16.0.19231.20156_neutral__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[4235]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-05T16:00:42.1190000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Office.ActionsServer_16.0.19231.20156_neutral__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[4236]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-05T16:00:42.1360000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.OfficePushNotificationUtility_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[4237]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-05T16:00:43.2870000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Office.ActionsServer_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[4238]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-05T16:10:46.9240000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[4239]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-05T16:18:31.5890000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[4240]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-05T16:20:04.7670000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name t-ring-fdv2.msedge.net timed out after none of the configured DNS servers responded. Client PID 8644. 

Event[4241]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-05T17:06:13.7430000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[4242]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-05T17:30:29.5130000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[4243]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-05T18:14:16.6860000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[4244]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-05T18:17:46.3780000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[4245]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-05T18:18:44.6450000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\SystemAppData\Helium\User.dat was cleared updating 17 keys and creating 1 modified pages. 

Event[4246]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-05T18:18:44.6500000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat was cleared updating 17 keys and creating 2 modified pages. 

Event[4247]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-05T18:18:44.7960000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Paint_8wekyb3d8bbwe\SystemAppData\Helium\User.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[4248]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-05T18:18:44.8010000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Paint_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[4249]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-05T18:18:45.0040000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 12 keys and creating 3 modified pages. 

Event[4250]
  Log Name: System
  Source: Microsoft-Windows-WPDClassInstaller
  Date: 2025-10-05T18:40:37.6300000Z
  Event ID: 24576
  Task: Driver Installation 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Drivers were successfully installed for device WPD Device. 

Event[4251]
  Log Name: System
  Source: Microsoft-Windows-WPDClassInstaller
  Date: 2025-10-05T18:40:37.6890000Z
  Event ID: 24577
  Task: Driver Installation 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Media player and imaging program compatibility layers were successfully registered for device %1. Layer bits %2 were requested, layer bits %3 were registered. 

Event[4252]
  Log Name: System
  Source: Microsoft-Windows-WPDClassInstaller
  Date: 2025-10-05T18:40:37.6910000Z
  Event ID: 24579
  Task: Driver Installation 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoplay registration was skipped for device %1. 

Event[4253]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-10-05T18:40:37.4820000Z
  Event ID: 10000
  Task: Startup of the UMDF reflector 
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A driver package which uses user-mode driver framework version 2.35.0 is being installed on device SWD\WPDBUSENUM\_??_USBSTOR#DISK&VEN_SANDISK&PROD_ULTRA_USB_3.0&REV_1.00#4C530001200812101440&0#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}. 

Event[4254]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-10-05T18:40:37.4920000Z
  Event ID: 10002
  Task: Startup of the UMDF reflector 
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The UMDF service WpdFs (CLSID {112de495-ac4c-46f8-b663-6a4266c53313}) was upgraded.  It requires framework version 2.35.0 or higher. 

Event[4255]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-10-05T18:40:37.5010000Z
  Event ID: 10100
  Task: Startup of the UMDF reflector 
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The driver package installation has succeeded. 

Event[4256]
  Log Name: System
  Source: Microsoft-Windows-UserPnp
  Date: 2025-10-05T18:40:37.5250000Z
  Event ID: 20003
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Driver Management has concluded the process to add Service WUDFWpdFs for Device Instance ID SWD\WPDBUSENUM\_??_USBSTOR#DISK&VEN_SANDISK&PROD_ULTRA_USB_3.0&REV_1.00#4C530001200812101440&0#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B} with the following status: 0. 

Event[4257]
  Log Name: System
  Source: Virtual Disk Service
  Date: 2025-10-05T18:41:44.1180000Z
  Event ID: 3
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Service started. 

Event[4258]
  Log Name: System
  Source: Virtual Disk Service
  Date: 2025-10-05T18:43:37.8440000Z
  Event ID: 4
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Service stopped. 

Event[4259]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-05T18:51:20.8290000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[4260]
  Log Name: System
  Source: User32
  Date: 2025-10-05T18:51:25.5420000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[4261]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-05T18:51:26.4620000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[4262]
  Log Name: System
  Source: EventLog
  Date: 2025-10-05T18:51:26.9450000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[4263]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-05T18:51:26.8730000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[4264]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-05T18:51:26.9400000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[4265]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-05T18:51:26.9400000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[4266]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-05T18:51:26.9420000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[4267]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-05T18:51:26.9430000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[4268]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-05T18:51:26.9440000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[4269]
  Log Name: System
  Source: EventLog
  Date: 2025-10-06T07:27:00.4560000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[4270]
  Log Name: System
  Source: EventLog
  Date: 2025-10-06T07:27:00.4570000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[4271]
  Log Name: System
  Source: EventLog
  Date: 2025-10-06T07:27:00.4580000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 8 seconds. 

Event[4272]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-05T18:51:27.1940000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[4273]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-05T18:51:27.2430000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[4274]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-05T18:51:27.4140000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[4275]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-05T18:51:27.8850000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[4276]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-05T18:51:27.8850000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[4277]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-05T18:51:28.1550000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[4278]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-05T18:51:28.4500000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?05T14:51:28.450321300Z. 

Event[4279]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:26:52.1930000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?06T03:26:51.500000000Z. 

Event[4280]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:26:52.1930000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?06T03:26:51.500000000Z. 

Loader time: ?2025?-?10?-?06T03:26:51.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[4281]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-06T07:26:52.1940000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[4282]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-06T07:26:52.1940000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[4283]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-06T07:26:52.1940000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[4284]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-06T07:26:52.1940000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[4285]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-06T07:26:52.1940000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[4286]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-06T07:26:52.1940000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?06T08:56:51.000000000Z. 

Event[4287]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-06T07:26:52.1940000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[4288]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-06T07:26:52.1940000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[4289]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-06T07:26:52.1970000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[4290]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:26:52.1970000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[4291]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-06T07:26:52.2290000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[4292]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-06T07:26:52.3720000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[4293]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-06T07:26:52.6030000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4294]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-06T07:26:52.6040000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4295]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-06T07:26:52.6060000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4296]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-06T07:26:53.1600000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[4297]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-06T07:26:53.3610000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4298]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-06T07:26:53.3720000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4299]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-06T07:26:53.5750000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4300]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-06T07:26:53.6320000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[4301]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-06T07:26:53.6320000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[4302]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-06T07:26:53.6370000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[4303]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:26:53.6430000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \SystemRoot\System32\Config\SECURITY was cleared updating 92 keys and creating 4 modified pages. 

Event[4304]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:26:53.6500000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \SystemRoot\System32\Config\SAM was cleared updating 57 keys and creating 6 modified pages. 

Event[4305]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:26:53.6710000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \SystemRoot\System32\Config\DEFAULT was cleared updating 753 keys and creating 100 modified pages. 

Event[4306]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-06T07:26:54.4470000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[4307]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-06T07:26:54.4900000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4308]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-06T07:26:54.5000000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4309]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-06T07:26:54.5100000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4310]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-06T07:26:54.5120000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4311]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-06T07:26:54.5110000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[4312]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-06T07:26:54.5130000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[4313]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-06T07:26:54.5150000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4314]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-06T07:26:54.5170000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4315]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-06T07:26:54.5180000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4316]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-06T07:26:54.5220000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4317]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-06T07:26:54.5260000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[4318]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-06T07:26:54.5930000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[4319]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:26:54.6930000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \Device\HarddiskVolume1\EFI\Microsoft\Boot\BCD was cleared updating 133 keys and creating 6 modified pages. 

Event[4320]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-06T07:26:55.2970000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[4321]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:26:55.4630000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \Device\HarddiskVolume1\EFI\Microsoft\Boot\BCD was cleared updating 133 keys and creating 6 modified pages. 

Event[4322]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:26:55.5140000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \Device\HarddiskVolume1\EFI\Microsoft\Boot\BCD was cleared updating 133 keys and creating 6 modified pages. 

Event[4323]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-06T07:26:55.5300000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[4324]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:26:55.5480000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \Device\HarddiskVolume1\EFI\Microsoft\Boot\BCD was cleared updating 133 keys and creating 6 modified pages. 

Event[4325]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:26:55.5510000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \Device\HarddiskVolume1\EFI\Microsoft\Boot\BCD was cleared updating 133 keys and creating 6 modified pages. 

Event[4326]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:26:55.5530000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \Device\HarddiskVolume1\EFI\Microsoft\Boot\BCD was cleared updating 133 keys and creating 6 modified pages. 

Event[4327]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:26:56.7470000Z
  Event ID: 15
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Hive \SystemRoot\System32\Config\SOFTWARE was reorganized with a starting size of 118308864 bytes and an ending size of 110739456 bytes. 

Event[4328]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:26:56.7770000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[4329]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:26:56.7850000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \Device\HarddiskVolume1\EFI\Microsoft\Boot\BCD was cleared updating 133 keys and creating 6 modified pages. 

Event[4330]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-06T07:26:59.0210000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[4331]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-06T07:26:59.0210000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[4332]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-06T07:26:59.0220000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[4333]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-06T07:26:59.0230000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[4334]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-06T07:26:59.1160000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[4335]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-06T07:26:59.1180000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[4336]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-06T07:26:59.1740000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[4337]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-06T07:26:59.3510000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[4338]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-06T07:26:59.3640000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[4339]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-06T07:26:59.3640000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[4340]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:26:59.9820000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\WINDOWS\ServiceProfiles\NetworkService\NTUSER.DAT was cleared updating 158 keys and creating 18 modified pages. 

Event[4341]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:27:00.1860000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \SystemRoot\System32\Config\BBI was cleared updating 264 keys and creating 68 modified pages. 

Event[4342]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:27:00.2260000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\WINDOWS\ServiceProfiles\LocalService\NTUSER.DAT was cleared updating 174 keys and creating 22 modified pages. 

Event[4343]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-06T07:27:00.3070000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4344]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-06T07:27:00.3120000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4345]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-06T07:27:00.3230000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4346]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-06T07:27:00.3390000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4347]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-06T07:27:00.3580000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4348]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-06T07:27:00.3580000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[4349]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-06T07:27:00.3580000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4350]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-06T07:27:00.3640000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4351]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-06T07:27:00.3710000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4352]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-06T07:27:00.3790000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4353]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-06T07:27:00.6770000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[4354]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-06T07:27:00.6770000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[4355]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-06T07:27:00.6780000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[4356]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-06T07:27:00.7270000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[4357]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-06T07:27:00.9300000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4358]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-06T07:27:00.9300000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4359]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-06T07:27:00.9300000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4360]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-06T07:27:00.9300000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4361]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-06T07:27:00.9300000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4362]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-06T07:27:00.9300000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4363]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-06T07:27:00.9300000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4364]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-06T07:27:00.9300000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4365]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-06T07:27:00.9300000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4366]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-06T07:27:00.9300000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4367]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-06T07:27:00.9300000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4368]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-06T07:27:00.9300000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4369]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-06T07:27:00.9300000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4370]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-06T07:27:00.9300000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4371]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-06T07:27:00.9570000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[4372]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:27:00.9730000Z
  Event ID: 15
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Hive \SystemRoot\System32\config\DRIVERS was reorganized with a starting size of 10153984 bytes and an ending size of 8482816 bytes. 

Event[4373]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-06T07:27:01.3880000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[4374]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:27:01.4160000Z
  Event ID: 15
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Hive \??\C:\Users\aaron\ntuser.dat was reorganized with a starting size of 14761984 bytes and an ending size of 14831616 bytes. 

Event[4375]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:27:01.4840000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Microsoft\Windows\UsrClass.dat was cleared updating 2933 keys and creating 476 modified pages. 

Event[4376]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-06T07:27:03.9460000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[4377]
  Log Name: System
  Source: TPM
  Date: 2025-10-06T07:27:03.9490000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[4378]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-06T07:27:04.0840000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[4379]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:27:04.0980000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\WINDOWS\AppCompat\Programs\Amcache.hve was cleared updating 1913 keys and creating 674 modified pages. 

Event[4380]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-06T07:27:04.1670000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[4381]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-06T07:27:05.7980000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[4382]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-06T07:27:05.7990000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000035-0000000000.json for detailed information on what checks were made. 

Event[4383]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:27:07.2290000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat was cleared updating 17 keys and creating 5 modified pages. 

Event[4384]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:27:07.2790000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\User.dat was cleared updating 18 keys and creating 3 modified pages. 

Event[4385]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:27:07.2830000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\UserClasses.dat was cleared updating 13 keys and creating 1 modified pages. 

Event[4386]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:27:07.8440000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat was cleared updating 16 keys and creating 1 modified pages. 

Event[4387]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:27:07.8980000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat was cleared updating 5 keys and creating 1 modified pages. 

Event[4388]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:27:08.3540000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\Settings\settings.dat was cleared updating 6 keys and creating 1 modified pages. 

Event[4389]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:27:10.6820000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages. 

Event[4390]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-06T07:27:11.4350000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[4391]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-06T07:27:11.9910000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[4392]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-06T07:27:32.0250000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4393]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:27:36.3390000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\aimgr_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages. 

Event[4394]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:27:55.1910000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 17 keys and creating 4 modified pages. 

Event[4395]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:28:00.3260000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat was cleared updating 246 keys and creating 20 modified pages. 

Event[4396]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-06T07:28:01.9080000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4397]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:28:04.9450000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\dosvcState.dat was cleared updating 38 keys and creating 10 modified pages. 

Event[4398]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-06T07:28:05.6570000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4399]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-06T07:28:05.6570000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4400]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-06T07:28:05.6730000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4401]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-06T07:28:05.6730000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4402]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-06T07:28:05.6730000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4403]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-06T07:28:05.6730000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4404]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-06T07:28:05.6730000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4405]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-06T07:28:05.6730000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4406]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-06T07:28:35.7430000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[4407]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-06T07:29:09.4900000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4408]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-06T07:29:09.4900000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4409]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-06T07:29:09.4900000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4410]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-06T07:29:54.9350000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4411]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-06T07:31:08.1850000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4412]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-06T07:32:01.0810000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[4413]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-06T07:32:01.0810000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[4414]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-06T07:32:43.4420000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name imgs.search.brave.com timed out after none of the configured DNS servers responded. Client PID 6520. 

Event[4415]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-06T07:33:51.5010000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4416]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-06T07:33:51.5040000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4417]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-06T07:33:51.5050000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4418]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-06T07:33:51.5070000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4419]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-06T07:37:22.7070000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4420]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-06T07:38:15.4020000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[4421]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-06T07:38:19.3430000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.352.0) - Current Channel (Broad) 

Event[4422]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-06T07:38:35.0710000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.352.0) - Current Channel (Broad) 

Event[4423]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-06T07:39:33.0150000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4424]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:47:07.7540000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\SystemAppData\Helium\User.dat was cleared updating 7 keys and creating 1 modified pages. 

Event[4425]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T07:47:07.7590000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat was cleared updating 6 keys and creating 1 modified pages. 

Event[4426]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T08:09:18.7210000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[4427]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-06T08:09:50.2470000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[4428]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-06T08:09:50.4340000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[4429]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T08:10:10.3260000Z
  Event ID: 15
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy5\WINDOWS\System32\config\SYSTEM was reorganized with a starting size of 17797120 bytes and an ending size of 17506304 bytes. 

Event[4430]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T08:10:10.3290000Z
  Event ID: 11
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy5\WINDOWS\System32\config\SYSTEM (TM: {4cab4075-a264-11f0-a0c5-507b9da345ea}, RM: {4cab4074-a264-11f0-a0c5-507b9da345ea}) finished with result=0xC00000A2 (Internal code=7). 

Event[4431]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T08:10:10.6120000Z
  Event ID: 15
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy5\WINDOWS\System32\config\DRIVERS was reorganized with a starting size of 10153984 bytes and an ending size of 8482816 bytes. 

Event[4432]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T08:10:10.6140000Z
  Event ID: 11
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy5\WINDOWS\System32\config\DRIVERS (TM: {4cab4078-a264-11f0-a0c5-507b9da345ea}, RM: {4cab4077-a264-11f0-a0c5-507b9da345ea}) finished with result=0xC00000A2 (Internal code=7). 

Event[4433]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T08:10:13.9570000Z
  Event ID: 15
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy5\WINDOWS\System32\config\SOFTWARE was reorganized with a starting size of 110899200 bytes and an ending size of 110678016 bytes. 

Event[4434]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T08:10:13.9870000Z
  Event ID: 11
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy5\WINDOWS\System32\config\SOFTWARE (TM: {4cab407b-a264-11f0-a0c5-507b9da345ea}, RM: {4cab407a-a264-11f0-a0c5-507b9da345ea}) finished with result=0xC00000A2 (Internal code=7). 

Event[4435]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T08:10:28.3470000Z
  Event ID: 15
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Hive \??\Volume{1a7b3828-61d4-4cd2-b69a-63a772d651bf}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{DA92B5BB-9D10-4EC6-AA52-C08BC53EB1D6} was reorganized with a starting size of 17797120 bytes and an ending size of 17506304 bytes. 

Event[4436]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T08:10:28.4240000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\Volume{1a7b3828-61d4-4cd2-b69a-63a772d651bf}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{66923B89-1653-45A6-9C2C-117A4DBE5C33} was cleared updating 57 keys and creating 6 modified pages. 

Event[4437]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T08:10:28.5430000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\Volume{1a7b3828-61d4-4cd2-b69a-63a772d651bf}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{D51BDB85-F0CF-4C2C-9672-365B38B152B2} was cleared updating 80 keys and creating 4 modified pages. 

Event[4438]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T08:10:29.2840000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\Volume{1a7b3828-61d4-4cd2-b69a-63a772d651bf}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{5F3AF4C8-2F59-47E6-AB89-581CA5C0A160} was cleared updating 746 keys and creating 101 modified pages. 

Event[4439]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T08:10:32.2290000Z
  Event ID: 15
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Hive \??\Volume{1a7b3828-61d4-4cd2-b69a-63a772d651bf}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{71FE8AA9-3A20-4C1A-BC80-24BB3B28E4F5} was reorganized with a starting size of 110899200 bytes and an ending size of 110678016 bytes. 

Event[4440]
  Log Name: System
  Source: Tcpip
  Date: 2025-10-06T08:19:05.2170000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[4441]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-06T08:27:10.2810000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[4442]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-06T08:31:06.6210000Z
  Event ID: 187
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
User-mode process attempted to change the system state by calling SetSuspendState or SetSystemPowerState APIs. 

Event[4443]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-06T08:31:06.6360000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 0 to 1.

Reason ScreenOffGracePeriod 

BootId: 35 

Event[4444]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-06T08:31:07.2720000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: Application API 

Event[4445]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-06T08:31:09.0190000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[4446]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T08:31:12.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?06T04:31:12.500000000Z from ?2025?-?10?-?06T04:31:09.018971900Z.
Time Delta: 3481 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?06T10:01:12.500000000Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[4447]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-06T08:31:12.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 1, FullResume: 733, AverageResume: 733 

Event[4448]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-06T08:31:12.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 3860203, SuspendEnd: 3860204 

Event[4449]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-06T08:31:12.6830000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 1 to 2.

Reason SxTransition 

BootId: 35 

Event[4450]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-06T08:31:13.4150000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 2 to 4.

Reason Unknown 

BootId: 35 

Event[4451]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-06T08:31:13.7080000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?06T04:31:06.620600200Z
Wake Time: ?2025?-?10?-?06T04:31:12.665188600Z

Wake Source: Power Button 

Event[4452]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-06T08:31:25.8140000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[4453]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-06T08:48:32.6560000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[4454]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-06T09:05:36.6680000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[4455]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-06T09:22:40.6800000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[4456]
  Log Name: System
  Source: EventLog
  Date: 2025-10-06T10:30:00.6310000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 10989 seconds. 

Event[4457]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-06T10:40:03.7560000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[4458]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-06T11:32:46.6590000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[4459]
  Log Name: System
  Source: Tcpip
  Date: 2025-10-06T11:50:12.7170000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[4460]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-06T12:42:54.4920000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[4461]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T12:42:55.9560000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[4462]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T12:42:55.9560000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?06T08:42:55.956491600Z from ?2025?-?10?-?06T08:42:54.506372300Z.
Time Delta: 1450 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 2904).

RTC time: ?2025?-?10?-?06T14:12:55.956491600Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[4463]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-06T12:42:55.9570000Z
  Event ID: 35
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time service is now synchronizing the system time with the time source time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123) with reference id 3611644667. Current local stratum number is 4. 

Event[4464]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T12:42:55.9570000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[4465]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T12:42:55.9570000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?06T08:42:55.957318300Z from ?2025?-?10?-?06T08:42:55.956491600Z.
Time Delta: 0 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 2904).

RTC time: ?2025?-?10?-?06T14:12:55.957318300Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[4466]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T12:42:55.9590000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[4467]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T12:42:55.9590000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?06T08:42:55.958850200Z from ?2025?-?10?-?06T08:42:55.958169000Z.
Time Delta: 0 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 2904).

RTC time: ?2025?-?10?-?06T14:12:55.958850200Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[4468]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T14:31:11.8350000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 2 keys and creating 1 modified pages. 

Event[4469]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-06T15:55:56.5890000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4470]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-06T15:58:01.3430000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4471]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-06T16:31:13.6660000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4472]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-06T16:33:19.8700000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4473]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-06T17:07:26.9090000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4474]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T17:07:45.3590000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\WINDOWS\System32\config\COMPONENTS was cleared updating 87309 keys and creating 9752 modified pages. 

Event[4475]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T17:07:45.3980000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\WINDOWS\System32\SMI\Store\Machine\schema.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[4476]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-06T17:07:48.7650000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[4477]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-06T17:09:31.0650000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4478]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-06T17:12:25.3110000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[4479]
  Log Name: System
  Source: Tcpip
  Date: 2025-10-06T18:27:31.6620000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[4480]
  Log Name: System
  Source: User32
  Date: 2025-10-06T19:00:39.1190000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[4481]
  Log Name: System
  Source: EventLog
  Date: 2025-10-06T19:00:40.9830000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[4482]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-06T19:00:40.3380000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[4483]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-06T19:00:40.5710000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[4484]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-06T19:00:40.8730000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[4485]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-06T19:00:40.9460000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[4486]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-06T19:00:40.9590000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[4487]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-06T19:00:40.9720000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[4488]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-06T19:00:40.9750000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[4489]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-06T19:00:40.9760000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[4490]
  Log Name: System
  Source: EventLog
  Date: 2025-10-07T07:31:32.4080000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[4491]
  Log Name: System
  Source: EventLog
  Date: 2025-10-07T07:31:32.4090000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[4492]
  Log Name: System
  Source: EventLog
  Date: 2025-10-07T07:31:32.4090000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[4493]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-06T19:00:41.3050000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[4494]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-06T19:00:41.3350000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[4495]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-06T19:00:41.8750000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[4496]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-06T19:00:41.8750000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[4497]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-06T19:00:45.9070000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[4498]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-06T19:00:48.4770000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[4499]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-06T19:00:48.6320000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?06T15:00:48.632421100Z. 

Event[4500]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-07T07:31:26.8980000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?07T03:31:26.500000000Z. 

Event[4501]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-07T07:31:26.8980000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?07T03:31:26.500000000Z. 

Loader time: ?2025?-?10?-?07T03:31:25.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[4502]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-07T07:31:26.8980000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[4503]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-07T07:31:26.8980000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[4504]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-07T07:31:26.8980000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[4505]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-07T07:31:26.8980000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[4506]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-07T07:31:26.8980000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[4507]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-07T07:31:26.8980000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?07T09:01:25.000000000Z. 

Event[4508]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-07T07:31:26.8980000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[4509]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-07T07:31:26.8980000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[4510]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-07T07:31:26.9020000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[4511]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-07T07:31:26.9030000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[4512]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-07T07:31:26.9340000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[4513]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-07T07:31:27.0830000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[4514]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-07T07:31:27.2880000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4515]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-07T07:31:27.2890000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4516]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-07T07:31:27.2900000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4517]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-07T07:31:27.8420000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[4518]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-07T07:31:28.0400000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4519]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-07T07:31:28.0520000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4520]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-07T07:31:28.2530000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4521]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-07T07:31:28.3120000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[4522]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-07T07:31:28.3120000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[4523]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-07T07:31:28.3170000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[4524]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-07T07:31:29.0970000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[4525]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-07T07:31:29.1390000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4526]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-07T07:31:29.1480000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4527]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-07T07:31:29.1490000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4528]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-07T07:31:29.1510000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4529]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-07T07:31:29.1570000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4530]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-07T07:31:29.1630000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[4531]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-07T07:31:29.1630000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[4532]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-07T07:31:29.1660000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4533]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-07T07:31:29.1680000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4534]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-07T07:31:29.2040000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4535]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-07T07:31:29.2080000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[4536]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-07T07:31:29.2650000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[4537]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-07T07:31:29.9360000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[4538]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-07T07:31:30.1470000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[4539]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-07T07:31:30.2260000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[4540]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-07T07:31:30.9620000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[4541]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-07T07:31:30.9630000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[4542]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-07T07:31:30.9630000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[4543]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-07T07:31:30.9640000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[4544]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-07T07:31:31.0570000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[4545]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-07T07:31:31.0590000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[4546]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-07T07:31:31.1100000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[4547]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-07T07:31:31.2890000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[4548]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-07T07:31:31.3010000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[4549]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-07T07:31:31.3010000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[4550]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-07T07:31:32.2600000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4551]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-07T07:31:32.2700000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4552]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-07T07:31:32.2830000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4553]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-07T07:31:32.2870000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4554]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-07T07:31:32.3060000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4555]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-07T07:31:32.3060000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[4556]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-07T07:31:32.3060000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4557]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-07T07:31:32.3120000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4558]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-07T07:31:32.3230000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4559]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-07T07:31:32.3310000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4560]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-07T07:31:32.6860000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[4561]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-07T07:31:32.6860000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[4562]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-07T07:31:32.6870000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[4563]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-07T07:31:32.7050000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[4564]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-07T07:31:32.8750000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[4565]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-07T07:31:32.9040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4566]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-07T07:31:32.9040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4567]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-07T07:31:32.9040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4568]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-07T07:31:32.9040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4569]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-07T07:31:32.9040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4570]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-07T07:31:32.9040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4571]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-07T07:31:32.9040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4572]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-07T07:31:32.9040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4573]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-07T07:31:32.9040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4574]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-07T07:31:32.9040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4575]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-07T07:31:32.9040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4576]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-07T07:31:32.9040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4577]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-07T07:31:32.9040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4578]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-07T07:31:32.9040000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4579]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-07T07:31:33.3440000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[4580]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-07T07:31:34.9460000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[4581]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-07T07:31:34.9460000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000036-0000000000.json for detailed information on what checks were made. 

Event[4582]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-07T07:31:35.1470000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[4583]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-07T07:31:35.2710000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[4584]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-07T07:31:35.3010000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[4585]
  Log Name: System
  Source: TPM
  Date: 2025-10-07T07:31:37.1980000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[4586]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-07T07:31:38.0680000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\SystemAppData\Helium\User.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[4587]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-07T07:31:38.0730000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat was cleared updating 15 keys and creating 3 modified pages. 

Event[4588]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-07T07:31:38.8930000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[4589]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-07T07:31:39.6980000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[4590]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-07T07:31:47.7380000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\AppleInc.iTunes_nzyj5cx40ttqa\SystemAppData\Helium\User.dat was cleared updating 17 keys and creating 2 modified pages. 

Event[4591]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-07T07:31:47.7440000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\AppleInc.iTunes_nzyj5cx40ttqa\SystemAppData\Helium\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[4592]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-07T07:31:56.8400000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4593]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-07T07:32:10.4190000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4594]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-07T07:32:40.3050000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4595]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-07T07:32:40.3050000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4596]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-07T07:32:40.3050000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4597]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-07T07:32:40.3050000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4598]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-07T07:32:40.3050000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4599]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-07T07:32:40.3280000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4600]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-07T07:32:40.3280000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4601]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-07T07:32:40.3280000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4602]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-07T07:32:46.8280000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4603]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-07T07:33:36.5540000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4604]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-07T07:33:36.5540000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4605]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-07T07:33:36.5540000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4606]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-07T07:34:09.0240000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[4607]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-07T07:36:32.9300000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[4608]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-07T07:36:32.9300000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[4609]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-07T07:38:15.6190000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4610]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-07T07:38:15.6190000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4611]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-07T07:38:15.6190000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4612]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-07T07:38:15.6270000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4613]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-07T07:43:34.5790000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[4614]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-07T07:43:46.3630000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.377.0) - Current Channel (Broad) 

Event[4615]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-07T07:44:00.5120000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.377.0) - Current Channel (Broad) 

Event[4616]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-07T08:07:43.9020000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[4617]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-07T08:08:14.4020000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[4618]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-07T08:08:14.5430000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[4619]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-07T08:09:29.5680000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from demand start to auto start. 

Event[4620]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-07T08:09:38.7340000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from auto start to demand start. 

Event[4621]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-07T08:17:17.8190000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[4622]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-07T08:25:34.4210000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[4623]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-07T08:25:51.2910000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4624]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-07T08:42:38.4320000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[4625]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-07T08:59:42.4390000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[4626]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-07T09:16:46.4470000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[4627]
  Log Name: System
  Source: EventLog
  Date: 2025-10-07T10:30:00.4050000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 10713 seconds. 

Event[4628]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-07T12:41:18.6160000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[4629]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-07T12:41:35.6390000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[4630]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-07T12:41:35.6390000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?07T08:41:35.639221600Z from ?2025?-?10?-?07T08:41:34.544255900Z.
Time Delta: 1094 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 5156).

RTC time: ?2025?-?10?-?07T14:11:35.639221600Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[4631]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-07T12:41:35.6390000Z
  Event ID: 35
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time service is now synchronizing the system time with the time source time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123) with reference id 3611644667. Current local stratum number is 4. 

Event[4632]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-07T12:41:35.6400000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[4633]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-07T12:41:35.6400000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?07T08:41:35.639997700Z from ?2025?-?10?-?07T08:41:35.639221600Z.
Time Delta: 0 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 5156).

RTC time: ?2025?-?10?-?07T14:11:35.639997700Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[4634]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-07T12:41:35.6410000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[4635]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-07T12:41:35.6410000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?07T08:41:35.641523700Z from ?2025?-?10?-?07T08:41:35.641073300Z.
Time Delta: 0 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 5156).

RTC time: ?2025?-?10?-?07T14:11:35.641523700Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[4636]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-07T13:06:51.4960000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\SystemAppData\Helium\User.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[4637]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-07T13:06:51.5010000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat was cleared updating 2 keys and creating 1 modified pages. 

Event[4638]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-07T13:12:46.3660000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[4639]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-07T13:34:07.3490000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[4640]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-07T14:18:09.6240000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name gw.aoscdn.com timed out after none of the configured DNS servers responded. Client PID 13304. 

Event[4641]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-07T14:18:31.9080000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name gw.wangxutech.com timed out after none of the configured DNS servers responded. Client PID 13304. 

Event[4642]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-07T14:54:10.7290000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name gw.aoscdn.com timed out after none of the configured DNS servers responded. Client PID 5544. 

Event[4643]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-07T15:02:43.7940000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4644]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-07T15:04:03.9360000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[4645]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-07T15:04:34.7690000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[4646]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-07T15:05:05.1690000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[4647]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-07T15:05:07.7220000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[4648]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-07T15:10:39.0850000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[4649]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-07T15:12:13.3380000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: 9PMMSR1CGPWG-Microsoft.HEIFImageExtension 

Event[4650]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-07T15:12:13.5210000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume ?? (\Device\HarddiskVolumeShadowCopy6) is healthy.  No action is needed. 

Event[4651]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-07T15:12:13.8320000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[4652]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-07T15:12:15.3980000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: 9PMMSR1CGPWG-Microsoft.HEIFImageExtension 

Event[4653]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-07T18:25:57.8820000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4654]
  Log Name: System
  Source: Volsnap
  Date: 2025-10-07T18:26:07.0370000Z
  Event ID: 33
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The oldest shadow copy of volume C: was deleted to keep disk space usage for shadow copies of volume C: below the user defined limit. 

Event[4655]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-07T18:28:02.9950000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4656]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-07T18:47:04.3630000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[4657]
  Log Name: System
  Source: Microsoft-Windows-UserModePowerService
  Date: 2025-10-07T19:16:51.0680000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Process C:\Windows\ImmersiveControlPanel\SystemSettings.exe (process ID:4156) reset policy scheme from {381b4222-f694-41f0-9685-ff5bb260df2e} to {381b4222-f694-41f0-9685-ff5bb260df2e} 

Event[4658]
  Log Name: System
  Source: Microsoft-Windows-UserModePowerService
  Date: 2025-10-07T19:16:51.1070000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Process C:\Windows\ImmersiveControlPanel\SystemSettings.exe (process ID:4156) reset policy scheme from {381b4222-f694-41f0-9685-ff5bb260df2e} to {381b4222-f694-41f0-9685-ff5bb260df2e} 

Event[4659]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-07T19:36:32.9400000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[4660]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-07T19:36:32.9400000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[4661]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-08T00:22:41.2790000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4662]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-08T00:24:45.4100000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4663]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-08T06:28:53.0360000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[4664]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-08T06:35:50.2590000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4665]
  Log Name: System
  Source: Tcpip
  Date: 2025-10-08T07:31:04.3250000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[4666]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-08T07:32:41.3910000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86401 seconds since the last report. 

Event[4667]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-08T07:32:41.4070000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86401 seconds since the last report. 

Event[4668]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-08T07:32:41.4070000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86401 seconds since the last report. 

Event[4669]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-08T07:32:41.4070000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86401 seconds since the last report. 

Event[4670]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-08T07:32:41.4070000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86401 seconds since the last report. 

Event[4671]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-08T07:32:41.4230000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86401 seconds since the last report. 

Event[4672]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-08T07:32:41.4230000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86401 seconds since the last report. 

Event[4673]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-08T07:32:41.4230000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86401 seconds since the last report. 

Event[4674]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-08T07:36:32.9210000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[4675]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-08T07:36:32.9210000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[4676]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-08T07:42:29.6000000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[4677]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-08T07:42:30.3050000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.393.0) - Current Channel (Broad) 

Event[4678]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-08T07:42:46.2910000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.437.393.0) - Current Channel (Broad) 

Event[4679]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-08T07:47:57.7650000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4680]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-08T07:57:15.9080000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4681]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-08T08:17:09.8430000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[4682]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-08T08:51:47.5480000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[4683]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-08T09:16:34.8460000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4684]
  Log Name: System
  Source: EventLog
  Date: 2025-10-08T10:30:00.6530000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 97113 seconds. 

Event[4685]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-08T12:51:39.5400000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[4686]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-08T15:03:27.0340000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4687]
  Log Name: System
  Source: Tcpip
  Date: 2025-10-08T15:13:12.3280000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[4688]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-08T15:34:37.5210000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[4689]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-08T15:54:48.3390000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FsDepends' (10.0, ?2012?-?11?-?16T16:39:29.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4690]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-08T15:55:56.6120000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4691]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-08T15:58:01.3630000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4692]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-08T16:00:40.0060000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[4693]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-08T16:01:24.4710000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[4694]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-08T16:01:25.3010000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[4695]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-08T16:01:58.8090000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.ScreenSketch_11.2508.28.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[4696]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-08T16:02:00.3920000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: 9MZ95KL8MR0L-Microsoft.ScreenSketch 

Event[4697]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-08T16:02:00.7070000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 2 keys and creating 1 modified pages. 

Event[4698]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-08T16:02:01.3840000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: 9MZ95KL8MR0L-Microsoft.ScreenSketch 

Event[4699]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-08T16:04:42.2840000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name waa-pa.clients6.google.com timed out after none of the configured DNS servers responded. Client PID 6556. 

Event[4700]
  Log Name: System
  Source: Tcpip
  Date: 2025-10-08T16:56:10.8150000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[4701]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-08T16:56:53.8490000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[4702]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-08T17:31:19.5930000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[4703]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-08T18:00:29.0730000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[4704]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-08T18:04:39.5490000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[4705]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-08T18:28:18.5660000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[4706]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-08T19:36:33.0550000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[4707]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-08T19:36:33.0550000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[4708]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-08T20:21:03.0220000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4709]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-08T20:23:07.1820000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4710]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-08T20:27:32.0640000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4711]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-08T20:29:36.2340000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4712]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T03:31:38.5260000Z
  Event ID: 11
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy6\WINDOWS\System32\config\SYSTEM (TM: {1afeda90-a32e-11f0-a0c6-507b9da345ea}, RM: {1afeda8f-a32e-11f0-a0c6-507b9da345ea}) finished with result=0xC00000A2 (Internal code=7). 

Event[4713]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T03:31:38.5890000Z
  Event ID: 11
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy6\WINDOWS\System32\config\DRIVERS (TM: {1afeda93-a32e-11f0-a0c6-507b9da345ea}, RM: {1afeda92-a32e-11f0-a0c6-507b9da345ea}) finished with result=0xC00000A2 (Internal code=7). 

Event[4714]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T03:31:39.3110000Z
  Event ID: 11
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy6\WINDOWS\System32\config\SOFTWARE (TM: {1afeda96-a32e-11f0-a0c6-507b9da345ea}, RM: {1afeda95-a32e-11f0-a0c6-507b9da345ea}) finished with result=0xC00000A2 (Internal code=7). 

Event[4715]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-09T06:26:09.4080000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[4716]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-09T06:26:42.6560000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[4717]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-09T06:27:37.4070000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.439.24.0) - Current Channel (Broad) 

Event[4718]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-09T06:28:36.6170000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.439.24.0) - Current Channel (Broad) 

Event[4719]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-09T06:31:29.9640000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4720]
  Log Name: System
  Source: Volsnap
  Date: 2025-10-09T06:31:30.7430000Z
  Event ID: 33
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The oldest shadow copy of volume C: was deleted to keep disk space usage for shadow copies of volume C: below the user defined limit. 

Event[4721]
  Log Name: System
  Source: Microsoft-Windows-Configuration-Change-Monitor
  Date: 2025-10-09T06:34:00.0470000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
N/A

Event[4722]
  Log Name: System
  Source: Microsoft-Windows-Configuration-Change-Monitor
  Date: 2025-10-09T06:34:00.1830000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
N/A

Event[4723]
  Log Name: System
  Source: Microsoft-Windows-Configuration-Change-Monitor
  Date: 2025-10-09T06:34:00.2800000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
N/A

Event[4724]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T06:34:01.4210000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (Version 6.1, ?2019?-?02?-?11T22:09:19.000000000Z) unloaded successfully. 

Event[4725]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T06:35:57.8890000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\DropboxInc.Dropbox_wkt425jdc3sga\Settings\settings.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[4726]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-09T06:36:01.1320000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4727]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T06:36:06.5430000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T22:09:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4728]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-09T06:44:03.3540000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4729]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-09T06:51:28.7110000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4730]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-09T06:55:59.9410000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4731]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-09T06:58:49.4400000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4732]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-09T07:03:02.7920000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[4733]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-09T07:04:13.4570000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume ?? (\Device\HarddiskVolumeShadowCopy7) is healthy.  No action is needed. 

Event[4734]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-09T07:04:33.8970000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume ?? (\Device\HarddiskVolumeShadowCopy8) is healthy.  No action is needed. 

Event[4735]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-09T07:04:47.6770000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  SQL Server VSS Writer
Service File Name:  "C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
Service Type:  user mode service
Service Start Type:  auto start
Service Account:  LocalSystem 

Event[4736]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-09T07:05:12.1830000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  FlexNet Licensing Service 64
Service File Name:  "C:\Program Files\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService64.exe"
Service Type:  user mode service
Service Start Type:  auto start
Service Account:  LocalSystem 

Event[4737]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-09T07:11:16.8790000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[4738]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-09T07:11:30.0670000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from demand start to auto start. 

Event[4739]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-09T07:11:41.6720000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[4740]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-09T07:11:43.3900000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  Autodesk Desktop App Service
Service File Name:  "C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AdAppMgrSvc.exe" 
Service Type:  user mode service
Service Start Type:  auto start
Service Account:  LocalSystem 

Event[4741]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-09T07:17:00.9160000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[4742]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-09T07:17:01.0430000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[4743]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T07:22:20.9710000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\Default\NTUSER.DAT was cleared updating 38 keys and creating 9 modified pages. 

Event[4744]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-09T07:22:25.9420000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from auto start to demand start. 

Event[4745]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-09T07:23:14.2470000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[4746]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-09T07:27:17.2710000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[4747]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T07:28:12.4780000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\DropboxInc.Dropbox_wkt425jdc3sga\SystemAppData\Helium\User.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[4748]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T07:28:12.4820000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\DropboxInc.Dropbox_wkt425jdc3sga\SystemAppData\Helium\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[4749]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-09T07:29:21.4750000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[4750]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T07:32:41.3940000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86400 seconds since the last report. 

Event[4751]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T07:32:41.4090000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86400 seconds since the last report. 

Event[4752]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T07:32:41.4090000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86400 seconds since the last report. 

Event[4753]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T07:32:41.4090000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86400 seconds since the last report. 

Event[4754]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T07:32:41.4090000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86400 seconds since the last report. 

Event[4755]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T07:32:41.4250000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86400 seconds since the last report. 

Event[4756]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T07:32:41.4250000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86400 seconds since the last report. 

Event[4757]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T07:32:41.4250000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86400 seconds since the last report. 

Event[4758]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-09T07:34:20.9430000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[4759]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-09T07:36:32.9350000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[4760]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-09T07:36:32.9350000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[4761]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-09T07:41:10.5810000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[4762]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-09T07:51:24.9500000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[4763]
  Log Name: System
  Source: User32
  Date: 2025-10-09T08:05:55.5750000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[4764]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-09T08:05:57.1930000Z
  Event ID: 10010
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The server {38E441FB-3D16-422F-8750-B2DACEC5CEFC} did not register with DCOM within the required timeout. 

Event[4765]
  Log Name: System
  Source: EventLog
  Date: 2025-10-09T08:05:58.4540000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[4766]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-09T08:05:58.0100000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[4767]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-09T08:05:58.1340000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[4768]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-09T08:05:58.3800000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[4769]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-09T08:05:58.4390000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[4770]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-09T08:05:58.4400000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[4771]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-09T08:05:58.4410000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[4772]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-09T08:05:58.4440000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[4773]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-09T08:05:58.4460000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[4774]
  Log Name: System
  Source: EventLog
  Date: 2025-10-09T08:07:24.5300000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[4775]
  Log Name: System
  Source: EventLog
  Date: 2025-10-09T08:07:24.5300000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[4776]
  Log Name: System
  Source: EventLog
  Date: 2025-10-09T08:07:24.5310000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 6 seconds. 

Event[4777]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-09T08:05:58.6680000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[4778]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-09T08:05:58.7360000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[4779]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-09T08:05:59.3930000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[4780]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-09T08:05:59.3930000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[4781]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-09T08:06:00.0210000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[4782]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-09T08:06:00.9530000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[4783]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T08:06:01.7290000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?09T04:06:01.729779400Z. 

Event[4784]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T08:07:18.9090000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?09T04:07:18.500000000Z. 

Event[4785]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T08:07:18.9090000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?09T04:07:18.500000000Z. 

Loader time: ?2025?-?10?-?09T04:07:18.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[4786]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-09T08:07:18.9090000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[4787]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-09T08:07:18.9090000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[4788]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-09T08:07:18.9090000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[4789]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-09T08:07:18.9090000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[4790]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-09T08:07:18.9090000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[4791]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-09T08:07:18.9090000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?09T09:37:18.000000000Z. 

Event[4792]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-09T08:07:18.9090000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[4793]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-09T08:07:18.9090000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[4794]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-09T08:07:18.9130000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[4795]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T08:07:18.9130000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[4796]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-09T08:07:18.9440000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[4797]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-09T08:07:19.0930000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[4798]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T08:07:19.3270000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4799]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T08:07:19.3280000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4800]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T08:07:19.3290000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4801]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-09T08:07:19.7300000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[4802]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T08:07:19.8540000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4803]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T08:07:19.8590000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4804]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T08:07:20.0310000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4805]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-09T08:07:20.0850000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[4806]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-09T08:07:20.0850000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[4807]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-09T08:07:20.0880000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[4808]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-09T08:07:20.8770000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[4809]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T08:07:20.9160000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4810]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T08:07:20.9260000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4811]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T08:07:20.9270000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4812]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T08:07:20.9290000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4813]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T08:07:20.9400000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4814]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T08:07:20.9430000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4815]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-09T08:07:20.9430000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[4816]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-09T08:07:20.9430000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[4817]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T08:07:20.9450000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4818]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T08:07:20.9520000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4819]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-09T08:07:20.9560000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[4820]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-09T08:07:21.0100000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[4821]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-09T08:07:21.6400000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[4822]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-09T08:07:21.8600000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[4823]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T08:07:21.9490000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[4824]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-10-09T08:07:22.1910000Z
  Event ID: 10118
  Task: Startup of the UMDF reflector 
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
UMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started yet. Will retry when it starts. 

Event[4825]
  Log Name: System
  Source: Microsoft-Windows-Kernel-PnP
  Date: 2025-10-09T08:07:22.1920000Z
  Event ID: 219
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The driver \Driver\WudfRd failed to load.
Device: USB\VID_05AC&PID_12A8&MI_00\6&302d0ec3&1&0000
Status: 0xC0000365 

Event[4826]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-09T08:07:22.8920000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[4827]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-09T08:07:22.8920000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[4828]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-09T08:07:22.8920000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[4829]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-09T08:07:22.8940000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[4830]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-09T08:07:23.0030000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[4831]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-09T08:07:23.0040000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[4832]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-09T08:07:23.0680000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[4833]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-09T08:07:23.2620000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[4834]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-09T08:07:23.2730000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[4835]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-09T08:07:23.2730000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[4836]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T08:07:24.3080000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4837]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T08:07:24.3210000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4838]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T08:07:24.3270000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4839]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T08:07:24.3490000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4840]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T08:07:24.3740000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4841]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T08:07:24.3740000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[4842]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T08:07:24.3750000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4843]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T08:07:24.3770000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4844]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T08:07:24.3860000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4845]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T08:07:24.3940000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4846]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-09T08:07:24.7040000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[4847]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-09T08:07:24.7040000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[4848]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-09T08:07:24.7040000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[4849]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-09T08:07:24.7350000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[4850]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T08:07:24.9570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4851]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T08:07:24.9570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4852]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T08:07:24.9570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4853]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T08:07:24.9570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4854]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T08:07:24.9570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4855]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T08:07:24.9570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4856]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T08:07:24.9570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4857]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T08:07:24.9570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4858]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T08:07:24.9570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4859]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T08:07:24.9570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4860]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T08:07:24.9570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4861]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T08:07:24.9570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4862]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T08:07:24.9580000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4863]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T08:07:24.9580000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4864]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-09T08:07:25.3370000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[4865]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-09T08:07:27.3040000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[4866]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-09T08:07:28.0140000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[4867]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-09T08:07:28.0140000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000037-0000000000.json for detailed information on what checks were made. 

Event[4868]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-09T08:07:28.0550000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[4869]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-09T08:07:28.1920000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[4870]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-09T08:07:28.2310000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[4871]
  Log Name: System
  Source: TPM
  Date: 2025-10-09T08:07:29.2340000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[4872]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-09T08:07:31.2770000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[4873]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-09T08:07:32.6890000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[4874]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T08:08:32.0860000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4875]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T08:08:32.0860000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4876]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T08:08:32.0860000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4877]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T08:08:32.0860000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4878]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T08:08:32.1010000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4879]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T08:08:32.1010000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4880]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T08:08:32.1020000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4881]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T08:08:32.1170000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[4882]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-09T08:09:29.7780000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4883]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-09T08:09:29.7780000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4884]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-09T08:10:02.3730000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[4885]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-09T08:12:25.0850000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[4886]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-09T08:12:25.0850000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[4887]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-09T08:17:55.6880000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[4888]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-09T08:18:32.6710000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[4889]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-09T08:19:36.4490000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.439.31.0) - Current Channel (Broad) 

Event[4890]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-09T08:19:48.4410000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.439.31.0) - Current Channel (Broad) 

Event[4891]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-09T08:22:26.4310000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[4892]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T08:29:01.8230000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[4893]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-09T08:50:56.2380000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[4894]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-09T08:58:43.3280000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[4895]
  Log Name: System
  Source: User32
  Date: 2025-10-09T09:00:44.9680000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[4896]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-09T09:00:45.6430000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[4897]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-09T09:00:45.7970000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[4898]
  Log Name: System
  Source: EventLog
  Date: 2025-10-09T09:00:46.0980000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[4899]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-09T09:00:46.0320000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[4900]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-09T09:00:46.0860000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[4901]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-09T09:00:46.0900000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[4902]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-09T09:00:46.0940000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[4903]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-09T09:00:46.0940000Z
  Event ID: 51057
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service stop is almost done.DHCP Context Ref count is 1 

Event[4904]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-09T09:00:46.0980000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[4905]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-09T09:00:46.0980000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[4906]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-09T09:00:46.2650000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[4907]
  Log Name: System
  Source: EventLog
  Date: 2025-10-09T11:23:15.3550000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[4908]
  Log Name: System
  Source: EventLog
  Date: 2025-10-09T11:23:15.3560000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[4909]
  Log Name: System
  Source: EventLog
  Date: 2025-10-09T11:23:15.3560000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[4910]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-09T09:00:46.2910000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[4911]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-09T09:00:46.7580000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[4912]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-09T09:00:47.0400000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[4913]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-09T09:00:47.0400000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[4914]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-09T09:00:49.0760000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[4915]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T09:00:49.2490000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?09T05:00:49.249970800Z. 

Event[4916]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T11:23:09.8900000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?09T07:23:09.500000000Z. 

Event[4917]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T11:23:09.8900000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?09T07:23:09.500000000Z. 

Loader time: ?2025?-?10?-?09T07:23:08.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[4918]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-09T11:23:09.8900000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[4919]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-09T11:23:09.8900000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[4920]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-09T11:23:09.8900000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[4921]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-09T11:23:09.8900000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[4922]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-09T11:23:09.8900000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[4923]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-09T11:23:09.8900000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?09T12:53:08.000000000Z. 

Event[4924]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-09T11:23:09.8900000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[4925]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-09T11:23:09.8900000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[4926]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-09T11:23:09.8940000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[4927]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T11:23:09.8950000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[4928]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-09T11:23:09.9240000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[4929]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-09T11:23:10.0870000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[4930]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T11:23:10.3100000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4931]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T11:23:10.3110000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4932]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T11:23:10.3120000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4933]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-09T11:23:10.7270000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[4934]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T11:23:10.8610000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4935]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T11:23:10.8670000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4936]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T11:23:11.0620000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4937]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-09T11:23:11.1240000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[4938]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-09T11:23:11.1240000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[4939]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-09T11:23:11.1290000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[4940]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-09T11:23:12.0600000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[4941]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T11:23:12.1030000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4942]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T11:23:12.1120000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4943]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T11:23:12.1130000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4944]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T11:23:12.1230000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4945]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T11:23:12.1240000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4946]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-09T11:23:12.1230000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[4947]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-09T11:23:12.1230000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[4948]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T11:23:12.1250000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4949]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T11:23:12.1270000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4950]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T11:23:12.1990000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[4951]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-09T11:23:12.3110000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[4952]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-09T11:23:12.3890000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[4953]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-09T11:23:12.8500000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[4954]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-09T11:23:13.0750000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[4955]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T11:23:13.1500000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[4956]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-09T11:23:13.8700000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[4957]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-09T11:23:13.8700000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[4958]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-09T11:23:13.8700000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[4959]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-09T11:23:13.8710000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[4960]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-09T11:23:13.9860000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[4961]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-09T11:23:13.9870000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[4962]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-09T11:23:14.0410000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[4963]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-09T11:23:14.2260000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[4964]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-09T11:23:14.2370000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[4965]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-09T11:23:14.2370000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[4966]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T11:23:15.1670000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4967]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T11:23:15.1840000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4968]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T11:23:15.2030000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4969]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T11:23:15.2290000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4970]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T11:23:15.2410000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4971]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T11:23:15.2560000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4972]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T11:23:15.2560000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[4973]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T11:23:15.2570000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4974]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T11:23:15.2630000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4975]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-09T11:23:15.2700000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[4976]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-09T11:23:15.6410000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[4977]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-09T11:23:15.6410000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[4978]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-09T11:23:15.6410000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[4979]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-09T11:23:15.6650000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[4980]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-09T11:23:15.8170000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[4981]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T11:23:15.8620000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4982]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T11:23:15.8620000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4983]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T11:23:15.8620000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4984]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T11:23:15.8620000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4985]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T11:23:15.8620000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4986]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T11:23:15.8620000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4987]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T11:23:15.8620000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4988]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T11:23:15.8620000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4989]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T11:23:15.8620000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4990]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T11:23:15.8620000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4991]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T11:23:15.8620000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4992]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T11:23:15.8620000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4993]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T11:23:15.8620000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4994]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-09T11:23:15.8620000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[4995]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-09T11:23:16.3400000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[4996]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-09T11:23:17.7660000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[4997]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-09T11:23:17.7660000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000038-0000000000.json for detailed information on what checks were made. 

Event[4998]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-09T11:23:18.0390000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[4999]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-09T11:23:18.1830000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[5000]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-09T11:23:18.2200000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[5001]
  Log Name: System
  Source: TPM
  Date: 2025-10-09T11:23:20.2120000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[5002]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-09T11:23:21.8620000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[5003]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-09T11:23:23.7270000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[5004]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T11:24:23.2720000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5005]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T11:24:23.2720000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5006]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T11:24:23.2720000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5007]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T11:24:23.2880000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5008]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T11:24:23.2880000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5009]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T11:24:23.2880000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5010]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T11:24:23.2880000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5011]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-09T11:24:23.2880000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5012]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-09T11:24:37.3580000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5013]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-09T11:25:19.7500000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5014]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-09T11:25:19.7510000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5015]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-09T11:25:19.7510000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5016]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-09T11:25:22.2090000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 and APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (S-1-15-2-3293255389-2908982027-869345523-1623449095-705585282-2692658063-3076634023). This security permission can be modified using the Component Services administrative tool. 

Event[5017]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-09T11:25:51.9270000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[5018]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-09T11:28:15.9070000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[5019]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-09T11:28:15.9070000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[5020]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T11:33:23.9040000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\e59fd33af7a9be35_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[5021]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-09T11:33:31.5100000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 and APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (S-1-15-2-1902406358-2670217533-2857690579-489018872-347519386-408094689-3630846653). This security permission can be modified using the Component Services administrative tool. 

Event[5022]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T11:47:50.8400000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat was cleared updating 2 keys and creating 1 modified pages. 

Event[5023]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T11:47:51.9420000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\MicrosoftWindows.CrossDevice_cw5n1h2txyewy\Settings\settings.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[5024]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-09T11:50:06.2350000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 and APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (S-1-15-2-2919262411-2659431446-1174169939-895624736-2815538268-2425538742-1903862385). This security permission can be modified using the Component Services administrative tool. 

Event[5025]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-09T11:50:58.3700000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5026]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T11:56:18.4010000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[5027]
  Log Name: System
  Source: Tcpip
  Date: 2025-10-09T12:18:48.2180000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[5028]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-09T13:21:34.7370000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 and APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (S-1-15-2-1297041225-512052199-4287513575-3151018350-2465948143-77723992-34923158). This security permission can be modified using the Component Services administrative tool. 

Event[5029]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-09T13:31:23.7130000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 and APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (S-1-15-2-3112517520-618166868-926783322-2727857961-552687559-694467392-2430284897). This security permission can be modified using the Component Services administrative tool. 

Event[5030]
  Log Name: System
  Source: Microsoft-Windows-WPDClassInstaller
  Date: 2025-10-09T13:37:54.1080000Z
  Event ID: 24576
  Task: Driver Installation 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Drivers were successfully installed for device WPD Device. 

Event[5031]
  Log Name: System
  Source: Microsoft-Windows-WPDClassInstaller
  Date: 2025-10-09T13:37:54.1550000Z
  Event ID: 24577
  Task: Driver Installation 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Media player and imaging program compatibility layers were successfully registered for device %1. Layer bits %2 were requested, layer bits %3 were registered. 

Event[5032]
  Log Name: System
  Source: Microsoft-Windows-WPDClassInstaller
  Date: 2025-10-09T13:37:54.1560000Z
  Event ID: 24579
  Task: Driver Installation 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoplay registration was skipped for device %1. 

Event[5033]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-10-09T13:37:53.8970000Z
  Event ID: 10000
  Task: Startup of the UMDF reflector 
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A driver package which uses user-mode driver framework version 2.35.0 is being installed on device SWD\WPDBUSENUM\_??_USBSTOR#DISK&VEN_VENDORCO&PROD_PRODUCTCODE&REV_2.00#6205161225439026518&0#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}. 

Event[5034]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-10-09T13:37:53.9070000Z
  Event ID: 10002
  Task: Startup of the UMDF reflector 
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The UMDF service WpdFs (CLSID {112de495-ac4c-46f8-b663-6a4266c53313}) was upgraded.  It requires framework version 2.35.0 or higher. 

Event[5035]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-10-09T13:37:53.9150000Z
  Event ID: 10100
  Task: Startup of the UMDF reflector 
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The driver package installation has succeeded. 

Event[5036]
  Log Name: System
  Source: Microsoft-Windows-UserPnp
  Date: 2025-10-09T13:37:53.9320000Z
  Event ID: 20003
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Driver Management has concluded the process to add Service WUDFWpdFs for Device Instance ID SWD\WPDBUSENUM\_??_USBSTOR#DISK&VEN_VENDORCO&PROD_PRODUCTCODE&REV_2.00#6205161225439026518&0#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B} with the following status: 0. 

Event[5037]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T14:31:11.4920000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\6b16c8ac92122987_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[5038]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-10-09T14:39:06.8720000Z
  Event ID: 10121
  Task: User-mode Driver problems. 
  Level: Critical 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
A runtime failure has occurred in user-mode driver AppleUsbFilter.dll and the hosting process has been terminated. This may temporarily interrupt your ability to access the devices. Please contact the device manufacturer or driver vendor for more information about this problem. 

Event[5039]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-10-09T14:39:06.8740000Z
  Event ID: 10120
  Task: User-mode Driver problems. 
  Level: Critical 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A problem has occurred with one or more user-mode drivers and the hosting process has been terminated.  This may temporarily interrupt your ability to access the devices. 

Event[5040]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-10-09T14:39:06.9120000Z
  Event ID: 10116
  Task: User-mode Driver problems. 
  Level: Critical 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The device Apple iPhone (location 0000.0014.0000.002.000.000.000.000.000) is offline due to a user-mode driver crash.  Windows will attempt to restart the device in the shared process 1 more times before moving the device in its own process.  Please contact the device manufacturer for more information about this problem. 

Event[5041]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-10-09T14:39:06.9120000Z
  Event ID: 10116
  Task: User-mode Driver problems. 
  Level: Critical 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The device Apple Mobile Device USB Device (location 0000.0014.0000.002.000.000.000.000.000) is offline due to a user-mode driver crash.  Windows will attempt to restart the device in the shared process 1 more times before moving the device in its own process.  Please contact the device manufacturer for more information about this problem. 

Event[5042]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-09T14:39:37.4640000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[5043]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-09T16:47:41.9080000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[5044]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-09T16:48:15.6000000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[5045]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-09T16:48:15.6000000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[5046]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-09T16:48:15.6000000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[5047]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T16:49:02.8140000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.StorePurchaseApp_22508.1401.3.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[5048]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-09T16:49:04.2290000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: 9NBLGGH4LS1F-Microsoft.StorePurchaseApp 

Event[5049]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T16:49:04.5580000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[5050]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-09T16:49:05.3750000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: 9NBLGGH4LS1F-Microsoft.StorePurchaseApp 

Event[5051]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T16:49:20.6870000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsStore_22508.1401.8.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[5052]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T16:49:21.8050000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.GetHelp_10.2409.32612.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[5053]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-09T16:49:22.0380000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: 9WZDNCRFJBMP-MICROSOFT.WINDOWSSTORE 

Event[5054]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-09T16:49:22.2580000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[5055]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-09T16:49:23.3330000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: 9WZDNCRFJBMP-MICROSOFT.WINDOWSSTORE 

Event[5056]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-09T16:49:23.6420000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: 9PKDZBMV1H3T-Microsoft.GetHelp 

Event[5057]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-09T16:49:23.8890000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[5058]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-09T16:49:24.4660000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: 9PKDZBMV1H3T-Microsoft.GetHelp 

Event[5059]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-09T17:27:18.2960000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 and APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (S-1-15-2-2000336474-3009859837-2491243707-934759693-3588285188-1083126775-553012041). This security permission can be modified using the Component Services administrative tool. 

Event[5060]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-09T17:46:39.2880000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[5061]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-09T17:48:43.8340000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[5062]
  Log Name: System
  Source: Tcpip
  Date: 2025-10-09T18:09:53.2220000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[5063]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-09T18:35:32.3700000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[5064]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-09T18:35:44.9080000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.439.39.0) - Current Channel (Broad) 

Event[5065]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-09T18:35:57.3740000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.439.39.0) - Current Channel (Broad) 

Event[5066]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-09T18:48:25.7600000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[5067]
  Log Name: System
  Source: Virtual Disk Service
  Date: 2025-10-09T19:09:49.7880000Z
  Event ID: 3
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Service started. 

Event[5068]
  Log Name: System
  Source: Microsoft-Windows-WPDClassInstaller
  Date: 2025-10-09T19:10:15.9740000Z
  Event ID: 24576
  Task: Driver Installation 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Drivers were successfully installed for device WPD Device. 

Event[5069]
  Log Name: System
  Source: Microsoft-Windows-WPDClassInstaller
  Date: 2025-10-09T19:10:16.0400000Z
  Event ID: 24577
  Task: Driver Installation 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Media player and imaging program compatibility layers were successfully registered for device %1. Layer bits %2 were requested, layer bits %3 were registered. 

Event[5070]
  Log Name: System
  Source: Microsoft-Windows-WPDClassInstaller
  Date: 2025-10-09T19:10:16.0410000Z
  Event ID: 24579
  Task: Driver Installation 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoplay registration was skipped for device %1. 

Event[5071]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-10-09T19:10:15.8770000Z
  Event ID: 10000
  Task: Startup of the UMDF reflector 
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A driver package which uses user-mode driver framework version 2.35.0 is being installed on device SWD\WPDBUSENUM\{CEA79A6D-A4E0-11F0-A0C8-507B9DA345EA}#0000000000100000. 

Event[5072]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-10-09T19:10:15.8920000Z
  Event ID: 10002
  Task: Startup of the UMDF reflector 
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The UMDF service WpdFs (CLSID {112de495-ac4c-46f8-b663-6a4266c53313}) was upgraded.  It requires framework version 2.35.0 or higher. 

Event[5073]
  Log Name: System
  Source: Microsoft-Windows-DriverFrameworks-UserMode
  Date: 2025-10-09T19:10:15.9030000Z
  Event ID: 10100
  Task: Startup of the UMDF reflector 
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The driver package installation has succeeded. 

Event[5074]
  Log Name: System
  Source: Microsoft-Windows-UserPnp
  Date: 2025-10-09T19:10:15.9350000Z
  Event ID: 20003
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Driver Management has concluded the process to add Service WUDFWpdFs for Device Instance ID SWD\WPDBUSENUM\{CEA79A6D-A4E0-11F0-A0C8-507B9DA345EA}#0000000000100000 with the following status: 0. 

Event[5075]
  Log Name: System
  Source: Virtual Disk Service
  Date: 2025-10-09T19:10:22.0730000Z
  Event ID: 4
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Service stopped. 

Event[5076]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-09T23:28:15.9230000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[5077]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-09T23:28:15.9230000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[5078]
  Log Name: System
  Source: User32
  Date: 2025-10-10T04:34:51.6960000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[5079]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-10T04:34:52.5630000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[5080]
  Log Name: System
  Source: EventLog
  Date: 2025-10-10T04:34:52.9770000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[5081]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-10T04:34:52.9110000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[5082]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-10T04:34:52.9690000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[5083]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-10T04:34:52.9690000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[5084]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-10T04:34:52.9720000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[5085]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-10T04:34:52.9760000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[5086]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-10T04:34:52.9760000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[5087]
  Log Name: System
  Source: EventLog
  Date: 2025-10-10T08:22:56.0980000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[5088]
  Log Name: System
  Source: EventLog
  Date: 2025-10-10T08:22:56.0990000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[5089]
  Log Name: System
  Source: EventLog
  Date: 2025-10-10T08:22:56.1000000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[5090]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-10T04:34:53.1440000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[5091]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-10T04:34:53.1670000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[5092]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-10T04:34:53.6420000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[5093]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-10T04:34:53.9240000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[5094]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-10T04:34:53.9240000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[5095]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-10T04:34:55.5970000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[5096]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-10T04:34:55.7760000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?10T00:34:55.776356500Z. 

Event[5097]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-10T08:22:50.9110000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?10T04:22:50.500000000Z. 

Event[5098]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-10T08:22:50.9110000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?10T04:22:50.500000000Z. 

Loader time: ?2025?-?10?-?10T04:22:49.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[5099]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-10T08:22:50.9120000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[5100]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-10T08:22:50.9120000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[5101]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-10T08:22:50.9120000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[5102]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-10T08:22:50.9120000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[5103]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-10T08:22:50.9120000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[5104]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-10T08:22:50.9120000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?10T09:52:49.000000000Z. 

Event[5105]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-10T08:22:50.9120000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[5106]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-10T08:22:50.9120000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[5107]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-10T08:22:50.9160000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[5108]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-10T08:22:50.9160000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[5109]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-10T08:22:50.9540000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[5110]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-10T08:22:51.1040000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[5111]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T08:22:51.3050000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5112]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T08:22:51.3060000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5113]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T08:22:51.3070000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5114]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-10T08:22:51.7680000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[5115]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T08:22:51.9090000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5116]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T08:22:51.9140000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5117]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T08:22:52.1230000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5118]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-10T08:22:52.1900000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[5119]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-10T08:22:52.1900000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[5120]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-10T08:22:52.1930000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[5121]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-10T08:22:53.1910000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[5122]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-10T08:22:53.2570000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[5123]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-10T08:22:53.2570000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[5124]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-10T08:22:53.2730000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5125]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-10T08:22:53.2820000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5126]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-10T08:22:53.2830000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5127]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-10T08:22:53.2840000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5128]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-10T08:22:53.2850000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5129]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-10T08:22:53.2870000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5130]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-10T08:22:53.2880000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5131]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-10T08:22:53.2890000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5132]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-10T08:22:53.2930000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[5133]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-10T08:22:53.3460000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[5134]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-10T08:22:54.0940000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[5135]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-10T08:22:54.2960000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[5136]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-10T08:22:54.3640000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[5137]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-10T08:22:55.1360000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[5138]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-10T08:22:55.1360000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[5139]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-10T08:22:55.1360000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[5140]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-10T08:22:55.1370000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[5141]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-10T08:22:55.2360000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[5142]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-10T08:22:55.2380000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[5143]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-10T08:22:55.2920000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[5144]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-10T08:22:55.4710000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[5145]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-10T08:22:55.4810000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[5146]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-10T08:22:55.4810000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[5147]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T08:22:55.9350000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5148]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T08:22:55.9420000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5149]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T08:22:55.9520000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5150]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T08:22:55.9710000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5151]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T08:22:55.9830000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5152]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T08:22:55.9990000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5153]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T08:22:55.9990000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[5154]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T08:22:55.9990000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5155]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T08:22:56.0100000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5156]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T08:22:56.0190000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5157]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-10T08:22:56.3230000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[5158]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-10T08:22:56.3230000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[5159]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-10T08:22:56.3230000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[5160]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-10T08:22:56.3760000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[5161]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T08:22:56.5840000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5162]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T08:22:56.5840000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5163]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T08:22:56.5840000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5164]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T08:22:56.5840000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5165]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T08:22:56.5840000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5166]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T08:22:56.5840000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5167]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T08:22:56.5840000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5168]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T08:22:56.5840000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5169]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T08:22:56.5840000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5170]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T08:22:56.5840000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5171]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T08:22:56.5840000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5172]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T08:22:56.5840000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5173]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T08:22:56.5840000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5174]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T08:22:56.5840000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5175]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-10T08:22:56.5880000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[5176]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-10T08:22:57.0300000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[5177]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-10T08:22:58.7360000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[5178]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-10T08:22:58.7360000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000039-0000000000.json for detailed information on what checks were made. 

Event[5179]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-10T08:22:59.0060000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[5180]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-10T08:22:59.1520000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[5181]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-10T08:22:59.1860000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[5182]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-10T08:23:00.4990000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\c93b3c73e758942_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[5183]
  Log Name: System
  Source: TPM
  Date: 2025-10-10T08:23:01.2240000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[5184]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-10T08:23:01.9340000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\26fe02ce68e5babf_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[5185]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-10T08:23:02.2040000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\81d060ca2aba6fa4_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[5186]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-10T08:23:02.6600000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[5187]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-10T08:23:02.9030000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[5188]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-10T08:23:04.8610000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[5189]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-10T08:23:07.2800000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 42 keys and creating 5 modified pages. 

Event[5190]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-10T08:23:07.4490000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\Helium\User.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[5191]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-10T08:23:07.4540000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\50b64a559478f671_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[5192]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-10T08:23:12.4060000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\AppleInc.iTunes_nzyj5cx40ttqa\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\28734fb83f5b5911_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[5193]
  Log Name: System
  Source: User32
  Date: 2025-10-10T08:23:57.9850000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[5194]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-10T08:23:58.7270000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[5195]
  Log Name: System
  Source: EventLog
  Date: 2025-10-10T08:23:59.2890000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[5196]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-10T08:23:59.2240000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[5197]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-10T08:23:59.2730000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[5198]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-10T08:23:59.2760000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[5199]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-10T08:23:59.2810000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[5200]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-10T08:23:59.2840000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[5201]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-10T08:23:59.2840000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[5202]
  Log Name: System
  Source: EventLog
  Date: 2025-10-10T12:51:00.4440000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[5203]
  Log Name: System
  Source: EventLog
  Date: 2025-10-10T12:51:00.4450000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[5204]
  Log Name: System
  Source: EventLog
  Date: 2025-10-10T12:51:00.4460000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[5205]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-10T08:23:59.4860000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[5206]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-10T08:23:59.5060000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[5207]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-10T08:23:59.7610000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[5208]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-10T08:24:00.2380000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[5209]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-10T08:24:00.2380000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[5210]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-10T08:24:00.3690000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[5211]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-10T08:24:00.5890000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?10T04:24:00.589728500Z. 

Event[5212]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-10T12:50:54.9600000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?10T08:50:54.500000000Z. 

Event[5213]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-10T12:50:54.9600000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?10T08:50:54.500000000Z. 

Loader time: ?2025?-?10?-?10T08:50:53.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[5214]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-10T12:50:54.9600000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[5215]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-10T12:50:54.9610000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[5216]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-10T12:50:54.9610000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[5217]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-10T12:50:54.9610000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[5218]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-10T12:50:54.9610000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[5219]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-10T12:50:54.9610000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?10T14:20:53.000000000Z. 

Event[5220]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-10T12:50:54.9610000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[5221]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-10T12:50:54.9610000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[5222]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-10T12:50:54.9640000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[5223]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-10T12:50:54.9650000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[5224]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-10T12:50:55.0010000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[5225]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-10T12:50:55.1630000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[5226]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T12:50:55.3930000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5227]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T12:50:55.3940000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5228]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T12:50:55.3960000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5229]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-10T12:50:55.7960000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[5230]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T12:50:55.9280000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5231]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T12:50:55.9330000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5232]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T12:50:56.1250000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5233]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-10T12:50:56.1850000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[5234]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-10T12:50:56.1850000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[5235]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-10T12:50:56.1920000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[5236]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-10T12:50:57.1060000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[5237]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-10T12:50:57.1730000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[5238]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-10T12:50:57.1730000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[5239]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-10T12:50:57.1850000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5240]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-10T12:50:57.1930000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5241]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-10T12:50:57.2000000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5242]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-10T12:50:57.2010000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5243]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-10T12:50:57.2020000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5244]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-10T12:50:57.2030000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5245]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-10T12:50:57.2050000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5246]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-10T12:50:57.2780000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5247]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-10T12:50:57.2830000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[5248]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-10T12:50:57.3380000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[5249]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-10T12:50:57.9270000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[5250]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-10T12:50:58.1380000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[5251]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-10T12:50:58.2150000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[5252]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-10T12:50:58.9720000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[5253]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-10T12:50:58.9720000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[5254]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-10T12:50:58.9720000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[5255]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-10T12:50:58.9730000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[5256]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-10T12:50:59.0830000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[5257]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-10T12:50:59.0850000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[5258]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-10T12:50:59.1370000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[5259]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-10T12:50:59.3260000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[5260]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-10T12:50:59.3380000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[5261]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-10T12:50:59.3380000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[5262]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T12:51:00.2750000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5263]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T12:51:00.2900000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5264]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T12:51:00.3000000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5265]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T12:51:00.3190000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5266]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T12:51:00.3420000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5267]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T12:51:00.3420000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[5268]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T12:51:00.3420000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5269]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T12:51:00.3480000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5270]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T12:51:00.3550000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5271]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-10T12:51:00.3630000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5272]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-10T12:51:00.6880000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[5273]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-10T12:51:00.6880000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[5274]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-10T12:51:00.6880000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[5275]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-10T12:51:00.7130000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[5276]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T12:51:00.9190000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5277]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T12:51:00.9190000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5278]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T12:51:00.9190000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5279]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T12:51:00.9190000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5280]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T12:51:00.9190000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5281]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T12:51:00.9190000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5282]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T12:51:00.9190000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5283]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T12:51:00.9190000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5284]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T12:51:00.9190000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5285]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T12:51:00.9190000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5286]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T12:51:00.9190000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5287]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T12:51:00.9190000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5288]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T12:51:00.9190000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5289]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-10T12:51:00.9190000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5290]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-10T12:51:00.9230000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[5291]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-10T12:51:01.3140000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[5292]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-10T12:51:02.7890000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[5293]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-10T12:51:02.7890000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000040-0000000000.json for detailed information on what checks were made. 

Event[5294]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-10T12:51:03.0920000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[5295]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-10T12:51:03.2220000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[5296]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-10T12:51:03.2590000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[5297]
  Log Name: System
  Source: TPM
  Date: 2025-10-10T12:51:05.3020000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[5298]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-10T12:51:06.8060000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[5299]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-10T12:51:08.3500000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[5300]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-10T12:51:43.7350000Z
  Event ID: 7011
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7011 - radio ON 

Event[5301]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-10T12:52:08.3520000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5302]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-10T12:52:08.3520000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5303]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-10T12:52:08.3670000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5304]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-10T12:52:08.3670000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5305]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-10T12:52:08.3670000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5306]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-10T12:52:08.3670000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5307]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-10T12:52:08.3670000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5308]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-10T12:52:08.3670000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5309]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-10T12:52:42.5900000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5310]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-10T12:53:09.3670000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5311]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-10T12:53:09.3670000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5312]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-10T12:53:09.3670000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5313]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-10T12:53:40.6030000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[5314]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-10T12:55:07.6550000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[5315]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-10T12:56:01.0530000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[5316]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-10T12:56:01.0530000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[5317]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-10T12:57:42.9640000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5318]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-10T12:57:42.9670000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5319]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-10T12:57:42.9670000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5320]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-10T12:57:42.9690000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5321]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-10T12:59:08.9980000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[5322]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-10T12:59:18.4070000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 5 keys and creating 1 modified pages. 

Event[5323]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-10T12:59:18.4900000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\95a2fadd2b2c1627_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[5324]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-10T13:01:33.9320000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[5325]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-10T13:01:41.6730000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[5326]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-10T13:01:45.7800000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.439.61.0) - Current Channel (Broad) 

Event[5327]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-10T13:01:51.6840000Z
  Event ID: 6105
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
6105 - deauth after EAPOL key exchange sequence 

Event[5328]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-10T13:01:56.2920000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.439.61.0) - Current Channel (Broad) 

Event[5329]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-10T13:02:09.0940000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name v10.events.data.microsoft.com timed out after none of the configured DNS servers responded. Client PID 3560. 

Event[5330]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-10T13:02:30.9030000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[5331]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-10T13:03:15.1180000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[5332]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-10T13:04:24.6700000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[5333]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-10T13:17:37.7160000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[5334]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-10T13:20:31.3220000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[5335]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-10T14:07:02.2970000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[5336]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-10T14:09:30.5200000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[5337]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-10T14:11:38.2060000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[5338]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-10T14:11:38.3810000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|[::]:123->[64:ff9b::2851:5e41]:123). 

Event[5339]
  Log Name: System
  Source: Tcpip
  Date: 2025-10-10T14:14:05.2150000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[5340]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-10T14:28:58.2390000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[5341]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-10T14:46:02.2460000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[5342]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-10T15:02:17.4190000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5343]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-10T15:03:06.2610000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[5344]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-10T15:12:57.9360000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[5345]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-10T15:14:15.6670000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[5346]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-10T15:20:10.2820000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[5347]
  Log Name: System
  Source: Tcpip
  Date: 2025-10-10T16:31:04.7080000Z
  Event ID: 4204
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Autoconfigured address limit has been reached. No further autoconfigured addresses will be added until the interface is reconnected. 

Event[5348]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-10T16:51:02.1840000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[5349]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-10T16:55:15.3110000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[5350]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-10T16:57:16.2560000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[5351]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-10T16:57:19.4320000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[5352]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-10T16:57:20.2450000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5353]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-10T17:40:29.4390000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name array506.prod.do.dsp.mp.microsoft.com timed out after none of the configured DNS servers responded. Client PID 9520. 

Event[5354]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-10T17:56:04.8180000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[5355]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-10T18:44:42.3020000Z
  Event ID: 134
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on 'time.windows.com,0x9'. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: No such host is known. (0x80072AF9) 

Event[5356]
  Log Name: System
  Source: User32
  Date: 2025-10-10T20:50:39.7970000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[5357]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-10T20:50:40.7150000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[5358]
  Log Name: System
  Source: EventLog
  Date: 2025-10-10T20:50:41.3040000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[5359]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-10T20:50:41.2400000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[5360]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-10T20:50:41.2950000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[5361]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-10T20:50:41.2960000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[5362]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-10T20:50:41.2970000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[5363]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-10T20:50:41.3040000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[5364]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-10T20:50:41.3040000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[5365]
  Log Name: System
  Source: EventLog
  Date: 2025-10-11T07:50:25.8380000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[5366]
  Log Name: System
  Source: EventLog
  Date: 2025-10-11T07:50:25.8390000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[5367]
  Log Name: System
  Source: EventLog
  Date: 2025-10-11T07:50:25.8390000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[5368]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-10T20:50:41.4970000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[5369]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-10T20:50:41.5170000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[5370]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-10T20:50:41.9040000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[5371]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-10T20:50:42.2440000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[5372]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-10T20:50:42.2440000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[5373]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-10T20:50:45.2480000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[5374]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-10T20:50:45.4200000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?10T16:50:45.420175300Z. 

Event[5375]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-11T07:50:20.8950000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?11T03:50:20.500000000Z. 

Event[5376]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-11T07:50:20.8950000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?11T03:50:20.500000000Z. 

Loader time: ?2025?-?10?-?11T03:50:19.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[5377]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T07:50:20.8950000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[5378]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T07:50:20.8950000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[5379]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T07:50:20.8950000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[5380]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T07:50:20.8960000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[5381]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T07:50:20.8960000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[5382]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T07:50:20.8960000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?11T09:20:19.000000000Z. 

Event[5383]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T07:50:20.8960000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[5384]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T07:50:20.8960000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[5385]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T07:50:20.9000000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[5386]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-11T07:50:20.9000000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[5387]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-11T07:50:20.9360000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[5388]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-11T07:50:21.0860000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[5389]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T07:50:21.3050000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5390]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T07:50:21.3060000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5391]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T07:50:21.3080000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5392]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-11T07:50:21.7220000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[5393]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T07:50:21.8100000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5394]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T07:50:21.8150000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5395]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T07:50:21.9230000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5396]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T07:50:21.9560000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[5397]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T07:50:21.9560000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[5398]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T07:50:21.9580000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[5399]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-11T07:50:22.4570000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[5400]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T07:50:22.5350000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5401]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-11T07:50:22.5410000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[5402]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T07:50:22.5440000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5403]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T07:50:22.5450000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5404]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T07:50:22.5460000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5405]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T07:50:22.5470000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5406]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T07:50:22.5480000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5407]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T07:50:22.5490000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5408]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T07:50:22.5990000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5409]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T07:50:22.6610000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[5410]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T07:50:22.7250000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[5411]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-11T07:50:23.1050000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[5412]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-11T07:50:23.3090000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[5413]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-11T07:50:23.3810000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[5414]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-11T07:50:24.3870000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[5415]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-11T07:50:24.3870000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[5416]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-11T07:50:24.3870000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[5417]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-11T07:50:24.3880000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[5418]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-11T07:50:24.4830000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[5419]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-11T07:50:24.4840000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[5420]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-11T07:50:24.5380000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[5421]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-11T07:50:24.7200000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[5422]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-11T07:50:24.7290000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[5423]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-11T07:50:24.7290000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[5424]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T07:50:25.6850000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5425]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T07:50:25.6950000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5426]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T07:50:25.7000000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5427]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T07:50:25.7150000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5428]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T07:50:25.7340000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5429]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T07:50:25.7340000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[5430]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T07:50:25.7340000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5431]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T07:50:25.7400000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5432]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T07:50:25.7470000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5433]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T07:50:25.7540000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5434]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T07:50:26.0720000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[5435]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T07:50:26.0720000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[5436]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T07:50:26.0720000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[5437]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-11T07:50:26.0930000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[5438]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T07:50:26.3360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5439]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T07:50:26.3360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5440]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T07:50:26.3360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5441]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T07:50:26.3360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5442]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T07:50:26.3360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5443]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T07:50:26.3360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5444]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T07:50:26.3360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5445]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T07:50:26.3360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5446]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T07:50:26.3360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5447]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T07:50:26.3360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5448]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T07:50:26.3360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5449]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T07:50:26.3360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5450]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T07:50:26.3360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5451]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T07:50:26.3360000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5452]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-11T07:50:26.3720000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[5453]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-11T07:50:26.7160000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[5454]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-11T07:50:28.1660000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[5455]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-11T07:50:28.1660000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000041-0000000000.json for detailed information on what checks were made. 

Event[5456]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-11T07:50:28.4530000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[5457]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-11T07:50:28.5940000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[5458]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-11T07:50:28.6310000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[5459]
  Log Name: System
  Source: TPM
  Date: 2025-10-11T07:50:31.2100000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[5460]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-11T07:50:32.7120000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[5461]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-11T07:50:34.1370000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[5462]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T07:51:33.7000000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5463]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T07:51:33.7000000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5464]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T07:51:33.7000000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5465]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T07:51:33.7160000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5466]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T07:51:33.7160000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5467]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T07:51:33.7160000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5468]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T07:51:33.7160000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5469]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T07:51:33.7160000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5470]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-11T07:52:29.7920000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5471]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-11T07:52:29.7920000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5472]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-11T07:52:29.7920000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5473]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-11T07:53:03.0220000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[5474]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-11T07:55:26.5180000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[5475]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-11T07:55:26.5180000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[5476]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-11T07:55:31.9560000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[5477]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-11T07:57:37.1160000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[5478]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-11T08:00:34.2950000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Edge.GameAssist_1.0.3590.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[5479]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-11T08:02:17.8030000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[5480]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-11T08:02:40.5410000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.439.79.0) - Current Channel (Broad) 

Event[5481]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-11T08:02:52.3950000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.439.79.0) - Current Channel (Broad) 

Event[5482]
  Log Name: System
  Source: User32
  Date: 2025-10-11T08:24:51.5260000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[5483]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-11T08:24:56.7390000Z
  Event ID: 10010
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The server {38E441FB-3D16-422F-8750-B2DACEC5CEFC} did not register with DCOM within the required timeout. 

Event[5484]
  Log Name: System
  Source: winsrvext
  Date: 2025-10-11T08:24:56.8460000Z
  Event ID: 100
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Process C:\Windows\explorer.exe is delaying system shutdown after 5016 milliseconds. 

Event[5485]
  Log Name: System
  Source: EventLog
  Date: 2025-10-11T08:24:57.7620000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[5486]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-11T08:24:57.1980000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[5487]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-11T08:24:57.2840000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[5488]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-11T08:24:57.6850000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[5489]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T08:24:57.7470000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[5490]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T08:24:57.7480000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[5491]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T08:24:57.7500000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[5492]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-11T08:24:57.7520000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[5493]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T08:24:57.7530000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[5494]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-11T08:24:57.9690000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[5495]
  Log Name: System
  Source: EventLog
  Date: 2025-10-11T11:02:53.5140000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[5496]
  Log Name: System
  Source: EventLog
  Date: 2025-10-11T11:02:53.5150000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[5497]
  Log Name: System
  Source: EventLog
  Date: 2025-10-11T11:02:53.5150000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 6 seconds. 

Event[5498]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-11T08:24:57.9940000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[5499]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-11T08:24:58.6870000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[5500]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-11T08:24:58.6870000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[5501]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T08:24:59.5230000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[5502]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T08:25:01.8270000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[5503]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-11T08:25:02.0740000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?11T04:25:02.074499800Z. 

Event[5504]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-11T11:02:47.8950000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?11T07:02:47.500000000Z. 

Event[5505]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-11T11:02:47.8950000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?11T07:02:47.500000000Z. 

Loader time: ?2025?-?10?-?11T07:02:46.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[5506]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T11:02:47.8950000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[5507]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T11:02:47.8950000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[5508]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T11:02:47.8950000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[5509]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T11:02:47.8950000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[5510]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T11:02:47.8950000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[5511]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T11:02:47.8950000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?11T12:32:46.000000000Z. 

Event[5512]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T11:02:47.8950000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[5513]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T11:02:47.8950000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[5514]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T11:02:47.8990000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[5515]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-11T11:02:47.9000000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[5516]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-11T11:02:47.9470000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[5517]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-11T11:02:48.1060000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[5518]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T11:02:48.3080000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5519]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T11:02:48.3090000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5520]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T11:02:48.3100000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5521]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-11T11:02:48.7330000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[5522]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T11:02:48.8760000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5523]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T11:02:48.8820000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5524]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T11:02:49.0850000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5525]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T11:02:49.1490000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[5526]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T11:02:49.1490000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[5527]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T11:02:49.1530000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[5528]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-11T11:02:50.1550000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[5529]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T11:02:50.1970000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5530]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T11:02:50.2060000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5531]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T11:02:50.2070000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5532]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T11:02:50.2090000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5533]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T11:02:50.2170000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5534]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T11:02:50.2200000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5535]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T11:02:50.2210000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5536]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-11T11:02:50.2400000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[5537]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T11:02:50.2490000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5538]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T11:02:50.2530000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[5539]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T11:02:50.3300000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[5540]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T11:02:50.3300000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[5541]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-11T11:02:51.0670000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[5542]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-11T11:02:51.2710000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[5543]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-11T11:02:51.3440000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[5544]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-11T11:02:52.0480000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[5545]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-11T11:02:52.0480000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[5546]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-11T11:02:52.0480000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[5547]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-11T11:02:52.0490000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[5548]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-11T11:02:52.1430000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[5549]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-11T11:02:52.1450000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[5550]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-11T11:02:52.1970000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[5551]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-11T11:02:52.3800000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[5552]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-11T11:02:52.3900000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[5553]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-11T11:02:52.3900000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[5554]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T11:02:53.3430000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5555]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T11:02:53.3600000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5556]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T11:02:53.3700000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5557]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T11:02:53.3890000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5558]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T11:02:53.4070000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5559]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T11:02:53.4070000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[5560]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T11:02:53.4080000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5561]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T11:02:53.4130000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5562]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T11:02:53.4240000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5563]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T11:02:53.4310000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5564]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T11:02:53.7670000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[5565]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T11:02:53.7670000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[5566]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T11:02:53.7670000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[5567]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-11T11:02:53.8210000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[5568]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-11T11:02:53.9830000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[5569]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T11:02:54.0010000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5570]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T11:02:54.0010000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5571]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T11:02:54.0010000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5572]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T11:02:54.0010000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5573]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T11:02:54.0010000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5574]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T11:02:54.0010000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5575]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T11:02:54.0010000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5576]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T11:02:54.0010000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5577]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T11:02:54.0010000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5578]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T11:02:54.0010000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5579]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T11:02:54.0010000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5580]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T11:02:54.0010000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5581]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T11:02:54.0010000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5582]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T11:02:54.0010000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5583]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-11T11:02:54.3570000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[5584]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-11T11:02:55.7850000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[5585]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-11T11:02:55.7860000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000042-0000000000.json for detailed information on what checks were made. 

Event[5586]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-11T11:02:56.3660000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[5587]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-11T11:02:56.5190000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[5588]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-11T11:02:56.5570000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[5589]
  Log Name: System
  Source: TPM
  Date: 2025-10-11T11:02:58.2180000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[5590]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-11T11:02:59.3350000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[5591]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-11T11:02:59.6880000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[5592]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-11T11:03:00.4510000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[5593]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-11T11:03:29.0420000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Edge.GameAssist_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages. 

Event[5594]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T11:03:29.5760000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[5595]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T11:04:01.3540000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5596]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T11:04:01.3700000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5597]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T11:04:01.3700000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5598]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T11:04:01.3700000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5599]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T11:04:01.3860000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5600]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T11:04:01.3860000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5601]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T11:04:01.3860000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5602]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T11:04:01.3860000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5603]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-11T11:04:58.2460000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5604]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-11T11:04:58.2460000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5605]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-11T11:05:04.5680000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[5606]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-11T11:07:54.0220000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[5607]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-11T11:07:54.0220000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[5608]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-11T11:51:12.1530000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5609]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-11T11:51:12.1600000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5610]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-11T11:51:12.1600000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5611]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-11T11:51:12.1620000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5612]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-11T11:55:03.2240000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[5613]
  Log Name: System
  Source: User32
  Date: 2025-10-11T13:15:57.6590000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[5614]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-11T13:15:58.4920000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[5615]
  Log Name: System
  Source: EventLog
  Date: 2025-10-11T13:15:59.0180000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[5616]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-11T13:15:58.9280000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[5617]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T13:15:58.9830000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[5618]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T13:15:58.9830000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[5619]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T13:15:58.9850000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[5620]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-11T13:15:58.9850000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[5621]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T13:15:58.9900000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[5622]
  Log Name: System
  Source: EventLog
  Date: 2025-10-11T14:04:40.3880000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[5623]
  Log Name: System
  Source: EventLog
  Date: 2025-10-11T14:04:40.3890000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[5624]
  Log Name: System
  Source: EventLog
  Date: 2025-10-11T14:04:40.3900000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[5625]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-11T13:15:59.1960000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[5626]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-11T13:15:59.2270000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[5627]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T13:15:59.3740000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[5628]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-11T13:15:59.9300000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[5629]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-11T13:15:59.9300000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[5630]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T13:16:05.3130000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[5631]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-11T13:16:05.4830000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?11T09:16:05.483655000Z. 

Event[5632]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-11T14:04:34.9080000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?11T10:04:34.500000000Z. 

Event[5633]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-11T14:04:34.9080000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?11T10:04:34.500000000Z. 

Loader time: ?2025?-?10?-?11T10:04:33.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[5634]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T14:04:34.9080000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[5635]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T14:04:34.9080000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[5636]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T14:04:34.9080000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[5637]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T14:04:34.9090000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[5638]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T14:04:34.9090000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[5639]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T14:04:34.9090000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?11T15:34:33.000000000Z. 

Event[5640]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T14:04:34.9090000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[5641]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T14:04:34.9090000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[5642]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T14:04:34.9130000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[5643]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-11T14:04:34.9130000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[5644]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-11T14:04:34.9470000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[5645]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-11T14:04:35.1120000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[5646]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T14:04:35.3290000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5647]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T14:04:35.3300000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5648]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T14:04:35.3310000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5649]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-11T14:04:35.7500000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[5650]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T14:04:35.8860000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5651]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T14:04:35.8920000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5652]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T14:04:36.0840000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5653]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T14:04:36.1460000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[5654]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T14:04:36.1460000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[5655]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T14:04:36.1520000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[5656]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-11T14:04:37.1000000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[5657]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T14:04:37.1440000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5658]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T14:04:37.1540000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5659]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T14:04:37.1550000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5660]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T14:04:37.1740000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5661]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T14:04:37.1760000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5662]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T14:04:37.1780000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5663]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T14:04:37.1790000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5664]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T14:04:37.1800000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5665]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T14:04:37.1850000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[5666]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-11T14:04:37.1860000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[5667]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T14:04:37.2560000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[5668]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-11T14:04:37.9530000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[5669]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-11T14:04:38.1550000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[5670]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-11T14:04:38.2280000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[5671]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-11T14:04:38.9260000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[5672]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-11T14:04:38.9260000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[5673]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-11T14:04:38.9260000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[5674]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-11T14:04:38.9270000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[5675]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-11T14:04:39.0210000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[5676]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-11T14:04:39.0220000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[5677]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-11T14:04:39.0760000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[5678]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-11T14:04:39.2800000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[5679]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-11T14:04:39.2930000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[5680]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-11T14:04:39.2930000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[5681]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T14:04:40.2180000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5682]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T14:04:40.2400000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5683]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T14:04:40.2490000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5684]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T14:04:40.2610000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5685]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T14:04:40.2840000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5686]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T14:04:40.2840000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[5687]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T14:04:40.2840000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5688]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T14:04:40.2900000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5689]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T14:04:40.2970000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5690]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T14:04:40.3040000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5691]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T14:04:40.6400000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[5692]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T14:04:40.6400000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[5693]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T14:04:40.6400000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[5694]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-11T14:04:40.6680000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[5695]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T14:04:40.8570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5696]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T14:04:40.8570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5697]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T14:04:40.8570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5698]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T14:04:40.8570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5699]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T14:04:40.8570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5700]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T14:04:40.8570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5701]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T14:04:40.8570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5702]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T14:04:40.8570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5703]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T14:04:40.8570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5704]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T14:04:40.8570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5705]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T14:04:40.8570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5706]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T14:04:40.8570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5707]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T14:04:40.8570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5708]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T14:04:40.8570000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5709]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-11T14:04:40.8740000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[5710]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-11T14:04:41.2680000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[5711]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-11T14:04:42.6830000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[5712]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-11T14:04:42.6830000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000043-0000000000.json for detailed information on what checks were made. 

Event[5713]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-11T14:04:42.9720000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[5714]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-11T14:04:43.1350000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[5715]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-11T14:04:43.1720000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[5716]
  Log Name: System
  Source: TPM
  Date: 2025-10-11T14:04:45.2320000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[5717]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-11T14:04:46.7300000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[5718]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-11T14:04:48.3030000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[5719]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-11T14:05:16.3690000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\AppleInc.iTunes_nzyj5cx40ttqa\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages. 

Event[5720]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-11T14:05:21.5180000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name t-ring-fdv2.msedge.net timed out after none of the configured DNS servers responded. Client PID 8692. 

Event[5721]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T14:05:48.3130000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5722]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T14:05:48.3130000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5723]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T14:05:48.3130000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5724]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T14:05:48.3440000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5725]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T14:05:48.3440000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5726]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T14:05:48.3450000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5727]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T14:05:48.3450000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5728]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T14:05:48.3450000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5729]
  Log Name: System
  Source: disk
  Date: 2025-10-11T14:05:52.6520000Z
  Event ID: 51
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
An error was detected on device \Device\Harddisk2\DR2 during a paging operation. 

Event[5730]
  Log Name: System
  Source: disk
  Date: 2025-10-11T14:05:52.6520000Z
  Event ID: 51
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
An error was detected on device \Device\Harddisk2\DR2 during a paging operation. 

Event[5731]
  Log Name: System
  Source: disk
  Date: 2025-10-11T14:05:52.6520000Z
  Event ID: 51
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
An error was detected on device \Device\Harddisk2\DR2 during a paging operation. 

Event[5732]
  Log Name: System
  Source: disk
  Date: 2025-10-11T14:05:52.6520000Z
  Event ID: 51
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
An error was detected on device \Device\Harddisk2\DR2 during a paging operation. 

Event[5733]
  Log Name: System
  Source: disk
  Date: 2025-10-11T14:05:52.6560000Z
  Event ID: 51
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
An error was detected on device \Device\Harddisk2\DR2 during a paging operation. 

Event[5734]
  Log Name: System
  Source: disk
  Date: 2025-10-11T14:05:52.6560000Z
  Event ID: 51
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
An error was detected on device \Device\Harddisk2\DR2 during a paging operation. 

Event[5735]
  Log Name: System
  Source: disk
  Date: 2025-10-11T14:05:52.6560000Z
  Event ID: 51
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
An error was detected on device \Device\Harddisk2\DR2 during a paging operation. 

Event[5736]
  Log Name: System
  Source: disk
  Date: 2025-10-11T14:06:02.2630000Z
  Event ID: 51
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
An error was detected on device \Device\Harddisk2\DR3 during a paging operation. 

Event[5737]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-11T14:06:44.6410000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5738]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-11T14:06:44.6410000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5739]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-11T14:06:44.6410000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5740]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-11T14:07:16.9430000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[5741]
  Log Name: System
  Source: User32
  Date: 2025-10-11T14:08:31.6830000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[5742]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-11T14:08:32.4910000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[5743]
  Log Name: System
  Source: EventLog
  Date: 2025-10-11T14:08:33.6050000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[5744]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-11T14:08:33.2470000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[5745]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-11T14:08:33.5230000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[5746]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T14:08:33.5920000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[5747]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T14:08:33.5930000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[5748]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T14:08:33.5970000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[5749]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-11T14:08:33.6050000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[5750]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T14:08:33.6050000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[5751]
  Log Name: System
  Source: EventLog
  Date: 2025-10-11T18:38:54.5140000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[5752]
  Log Name: System
  Source: EventLog
  Date: 2025-10-11T18:38:54.5140000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[5753]
  Log Name: System
  Source: EventLog
  Date: 2025-10-11T18:38:54.5150000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 6 seconds. 

Event[5754]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-11T14:08:33.8670000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[5755]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-11T14:08:33.8880000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[5756]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-11T14:08:34.5360000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[5757]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-11T14:08:34.5360000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[5758]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T14:08:35.7080000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[5759]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T14:08:36.3800000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[5760]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-11T14:08:36.6210000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?11T10:08:36.621303200Z. 

Event[5761]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-11T18:38:48.9080000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?11T14:38:48.500000000Z. 

Event[5762]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-11T18:38:48.9080000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?11T14:38:48.500000000Z. 

Loader time: ?2025?-?10?-?11T14:38:47.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[5763]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T18:38:48.9090000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[5764]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T18:38:48.9090000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[5765]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T18:38:48.9090000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[5766]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T18:38:48.9090000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[5767]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T18:38:48.9090000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[5768]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T18:38:48.9090000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?11T20:08:47.000000000Z. 

Event[5769]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T18:38:48.9090000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[5770]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T18:38:48.9090000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[5771]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-11T18:38:48.9130000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[5772]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-11T18:38:48.9130000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[5773]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-11T18:38:48.9510000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[5774]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-11T18:38:49.1140000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[5775]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T18:38:49.3360000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5776]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T18:38:49.3380000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5777]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T18:38:49.3390000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5778]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-11T18:38:49.7630000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[5779]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T18:38:49.9070000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5780]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T18:38:49.9130000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5781]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T18:38:50.1200000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5782]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T18:38:50.1850000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[5783]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T18:38:50.1850000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[5784]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T18:38:50.1900000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[5785]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-11T18:38:51.1930000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[5786]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T18:38:51.2360000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5787]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T18:38:51.2450000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5788]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T18:38:51.2460000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5789]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T18:38:51.2550000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5790]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T18:38:51.2580000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5791]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T18:38:51.2600000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5792]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T18:38:51.2610000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5793]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T18:38:51.2670000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5794]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T18:38:51.2720000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[5795]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-11T18:38:51.2740000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[5796]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T18:38:51.3560000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[5797]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T18:38:51.3560000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[5798]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-11T18:38:52.1030000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[5799]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-11T18:38:52.3300000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[5800]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-11T18:38:52.4010000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[5801]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-11T18:38:53.0850000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[5802]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-11T18:38:53.0850000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[5803]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-11T18:38:53.0850000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[5804]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-11T18:38:53.0860000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[5805]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-11T18:38:53.1820000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[5806]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-11T18:38:53.1830000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[5807]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-11T18:38:53.2350000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[5808]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-11T18:38:53.4090000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[5809]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-11T18:38:53.4210000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[5810]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-11T18:38:53.4210000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[5811]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T18:38:54.3650000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5812]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T18:38:54.3710000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5813]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T18:38:54.3810000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5814]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T18:38:54.3990000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5815]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T18:38:54.4190000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5816]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T18:38:54.4190000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[5817]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T18:38:54.4190000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5818]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T18:38:54.4250000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5819]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T18:38:54.4320000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5820]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-11T18:38:54.4400000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5821]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T18:38:54.7680000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[5822]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T18:38:54.7680000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[5823]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T18:38:54.7680000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[5824]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-11T18:38:54.7930000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[5825]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T18:38:54.9670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5826]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T18:38:54.9670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5827]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T18:38:54.9670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5828]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T18:38:54.9670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5829]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T18:38:54.9670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5830]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T18:38:54.9670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5831]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T18:38:54.9670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5832]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T18:38:54.9670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5833]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T18:38:54.9670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5834]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T18:38:54.9670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5835]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T18:38:54.9670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5836]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T18:38:54.9670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5837]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T18:38:54.9670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5838]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-11T18:38:54.9670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5839]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-11T18:38:55.0200000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[5840]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-11T18:38:55.3770000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[5841]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-11T18:38:57.1190000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[5842]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-11T18:38:57.1200000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000044-0000000000.json for detailed information on what checks were made. 

Event[5843]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-11T18:38:57.2070000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[5844]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-11T18:38:57.3470000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[5845]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-11T18:38:57.3880000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[5846]
  Log Name: System
  Source: TPM
  Date: 2025-10-11T18:38:59.2450000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[5847]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-11T18:39:00.8650000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[5848]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-11T18:39:01.6150000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[5849]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T18:40:02.4020000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5850]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T18:40:02.4020000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5851]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T18:40:02.4020000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5852]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T18:40:02.4180000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5853]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T18:40:02.4180000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5854]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T18:40:02.4180000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5855]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T18:40:02.4180000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5856]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-11T18:40:02.4180000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5857]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-11T18:40:59.3810000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5858]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-11T18:40:59.3850000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5859]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-11T18:40:59.3870000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5860]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-11T18:43:07.5990000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5861]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-11T18:43:07.6030000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5862]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-11T18:43:07.6030000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5863]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-11T18:43:07.6050000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5864]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-11T18:43:55.1370000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[5865]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-11T18:43:55.1370000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[5866]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-11T18:48:31.3680000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[5867]
  Log Name: System
  Source: User32
  Date: 2025-10-11T18:48:38.6370000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[5868]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-11T18:48:39.3290000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[5869]
  Log Name: System
  Source: EventLog
  Date: 2025-10-11T18:48:40.0020000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[5870]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-11T18:48:39.9210000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[5871]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T18:48:39.9810000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[5872]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T18:48:39.9830000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[5873]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T18:48:39.9860000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[5874]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-11T18:48:39.9870000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[5875]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-11T18:48:39.9870000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[5876]
  Log Name: System
  Source: EventLog
  Date: 2025-10-12T16:10:39.3640000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[5877]
  Log Name: System
  Source: EventLog
  Date: 2025-10-12T16:10:39.3650000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[5878]
  Log Name: System
  Source: EventLog
  Date: 2025-10-12T16:10:39.3660000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[5879]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-11T18:48:40.1680000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[5880]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-11T18:48:40.2070000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[5881]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T18:48:40.4170000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[5882]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-11T18:48:40.9210000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[5883]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-11T18:48:40.9210000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[5884]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-11T18:48:42.8250000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[5885]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-11T18:48:43.0420000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?11T14:48:43.042113400Z. 

Event[5886]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-12T16:10:33.8950000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?12T12:10:33.500000000Z. 

Event[5887]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-12T16:10:33.8950000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?12T12:10:33.500000000Z. 

Loader time: ?2025?-?10?-?12T12:10:33.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[5888]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-12T16:10:33.8950000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[5889]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-12T16:10:33.8950000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[5890]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-12T16:10:33.8950000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[5891]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-12T16:10:33.8960000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[5892]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-12T16:10:33.8960000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[5893]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-12T16:10:33.8960000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?12T17:40:33.000000000Z. 

Event[5894]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-12T16:10:33.8960000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[5895]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-12T16:10:33.8960000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[5896]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-12T16:10:33.8990000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[5897]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-12T16:10:33.9000000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[5898]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-12T16:10:33.9400000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[5899]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-12T16:10:34.1020000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[5900]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-12T16:10:34.3060000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5901]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-12T16:10:34.3070000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5902]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-12T16:10:34.3080000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5903]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-12T16:10:34.7410000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[5904]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-12T16:10:34.8730000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5905]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-12T16:10:34.8800000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5906]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-12T16:10:35.0880000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5907]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-12T16:10:35.1500000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[5908]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-12T16:10:35.1500000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[5909]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-12T16:10:35.1520000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[5910]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-12T16:10:36.0550000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[5911]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-12T16:10:36.0990000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5912]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-12T16:10:36.1080000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5913]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-12T16:10:36.1090000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5914]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-12T16:10:36.1160000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5915]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-12T16:10:36.1190000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5916]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-12T16:10:36.1200000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[5917]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-12T16:10:36.1200000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[5918]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-12T16:10:36.1220000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5919]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-12T16:10:36.1230000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5920]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-12T16:10:36.1280000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[5921]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-12T16:10:36.1320000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[5922]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-12T16:10:36.2040000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[5923]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-12T16:10:36.9620000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[5924]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-12T16:10:37.1640000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[5925]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-12T16:10:37.2330000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[5926]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-12T16:10:37.9020000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[5927]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-12T16:10:37.9020000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[5928]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-12T16:10:37.9020000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[5929]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-12T16:10:37.9040000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[5930]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-12T16:10:38.0020000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[5931]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-12T16:10:38.0040000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[5932]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-12T16:10:38.0570000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[5933]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-12T16:10:38.2380000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[5934]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-12T16:10:38.2490000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[5935]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-12T16:10:38.2490000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[5936]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-12T16:10:39.2040000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5937]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-12T16:10:39.2100000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5938]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-12T16:10:39.2200000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5939]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-12T16:10:39.2380000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5940]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-12T16:10:39.2500000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5941]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-12T16:10:39.2640000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5942]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-12T16:10:39.2640000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[5943]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-12T16:10:39.2640000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5944]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-12T16:10:39.2710000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5945]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-12T16:10:39.2790000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[5946]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-12T16:10:39.5790000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[5947]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-12T16:10:39.5800000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[5948]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-12T16:10:39.5800000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[5949]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-12T16:10:39.6110000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[5950]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-12T16:10:39.8260000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5951]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-12T16:10:39.8260000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5952]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-12T16:10:39.8260000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5953]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-12T16:10:39.8260000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5954]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-12T16:10:39.8260000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5955]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-12T16:10:39.8260000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5956]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-12T16:10:39.8260000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5957]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-12T16:10:39.8260000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5958]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-12T16:10:39.8260000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5959]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-12T16:10:39.8260000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5960]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-12T16:10:39.8260000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5961]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-12T16:10:39.8260000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5962]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-12T16:10:39.8260000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5963]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-12T16:10:39.8260000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[5964]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-12T16:10:39.8370000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[5965]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-12T16:10:40.2420000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[5966]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-12T16:10:41.7690000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[5967]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-12T16:10:41.7690000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000045-0000000000.json for detailed information on what checks were made. 

Event[5968]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-12T16:10:42.1170000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[5969]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-12T16:10:42.2620000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[5970]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-12T16:10:42.2980000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[5971]
  Log Name: System
  Source: TPM
  Date: 2025-10-12T16:10:44.2200000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[5972]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-12T16:10:45.5130000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[5973]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-12T16:10:45.8470000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[5974]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-12T16:10:47.3650000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[5975]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-12T16:11:47.2640000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5976]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-12T16:11:47.2640000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5977]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-12T16:11:47.2640000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5978]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-12T16:11:47.2790000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5979]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-12T16:11:47.2790000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5980]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-12T16:11:47.2790000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5981]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-12T16:11:47.2800000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5982]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-12T16:11:47.2950000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[5983]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-12T16:12:43.7970000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5984]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-12T16:12:43.8130000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5985]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-12T16:12:50.3510000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[5986]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-12T16:15:39.9820000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[5987]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-12T16:15:39.9820000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[5988]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-12T16:17:21.9150000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5989]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-12T16:17:21.9150000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5990]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-12T16:17:21.9210000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5991]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-12T16:17:21.9210000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[5992]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-12T16:18:49.3980000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[5993]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-12T16:18:54.7490000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 0 to 1.

Reason SessionUnlock 

BootId: 45 

Event[5994]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-12T16:19:03.8530000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 1 to 3.

Reason InputAccelerometer 

BootId: 45 

Event[5995]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-12T16:19:24.6120000Z
  Event ID: 7011
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7011 - radio ON 

Event[5996]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-12T16:21:14.2360000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[5997]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-12T16:21:14.8650000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.439.113.0) - Current Channel (Broad) 

Event[5998]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-12T16:21:28.2270000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.439.113.0) - Current Channel (Broad) 

Event[5999]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-12T16:25:27.9320000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[6000]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-12T16:25:31.4060000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 3 to 4.

Reason SessionUnlock 

BootId: 45 

Event[6001]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-12T16:27:44.4640000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 4 to 6.

Reason InputAccelerometer 

BootId: 45 

Event[6002]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-12T16:31:16.4490000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6003]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-12T16:34:36.6710000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[6004]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-12T16:34:58.8750000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\93bd85b35cc104b1_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[6005]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-12T16:35:07.9000000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[6006]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-12T16:35:32.4390000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  TPwSav
Service File Name:  c:\drivers\Touchpad Driver (Elan, Alps)\TPwSav.sys
Service Type:  kernel mode driver
Service Start Type:  demand start
Service Account:   

Event[6007]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-12T16:35:32.4710000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the TPwSav service was changed from demand start to system start. 

Event[6008]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-12T16:44:16.8290000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  TPwSav
Service File Name:  c:\drivers\Touchpad Driver (Elan, Alps)\TPwSav.sys
Service Type:  kernel mode driver
Service Start Type:  demand start
Service Account:   

Event[6009]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-12T16:44:16.8570000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the TPwSav service was changed from demand start to system start. 

Event[6010]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-12T16:49:52.5740000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[6011]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-12T16:54:58.2560000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 and APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (S-1-15-2-4170077716-1535899479-813565183-2456600766-3723262138-4158411635-3473866395). This security permission can be modified using the Component Services administrative tool. 

Event[6012]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-12T17:03:57.1080000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 and APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (S-1-15-2-2475793013-1816146159-114743186-1890854467-3960079915-559537913-3258918034). This security permission can be modified using the Component Services administrative tool. 

Event[6013]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-12T17:16:25.1400000Z
  Event ID: 111
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events triggered on a URL group, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
Create URL group 0xFE00000620000001. Status 0x0. Process Id 0xFB8 Executable path \Device\HarddiskVolume3\Users\aaron\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\LSB.exe, User S-1-5-21-1511219319-3122627625-3827747853-1001 

Event[6014]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-12T17:16:25.1410000Z
  Event ID: 113
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events triggered on a URL group, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
Attempted to add URL (http://localhost:50128/) to URL group (0xFE00000620000001). Status: 0x0. Process Id 0xFB8 Executable path \Device\HarddiskVolume3\Users\aaron\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\LSB.exe, User S-1-5-21-1511219319-3122627625-3827747853-1001 

Event[6015]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-12T17:31:58.7820000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 and APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (S-1-15-2-611657023-4050049-340925225-2203579108-962195327-1567029166-3272020130). This security permission can be modified using the Component Services administrative tool. 

Event[6016]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-12T17:52:51.5320000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[6017]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-12T17:52:51.7950000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->40.81.94.65:123). 

Event[6018]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-12T17:54:38.2390000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[6019]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-12T17:54:50.3440000Z
  Event ID: 11
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy5\WINDOWS\System32\config\SYSTEM (TM: {741e4943-a764-11f0-a0cf-507b9da345ea}, RM: {741e4942-a764-11f0-a0cf-507b9da345ea}) finished with result=0xC00000A2 (Internal code=7). 

Event[6020]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-12T17:54:50.4060000Z
  Event ID: 11
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy5\WINDOWS\System32\config\DRIVERS (TM: {741e4946-a764-11f0-a0cf-507b9da345ea}, RM: {741e4945-a764-11f0-a0cf-507b9da345ea}) finished with result=0xC00000A2 (Internal code=7). 

Event[6021]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-12T17:54:51.4670000Z
  Event ID: 11
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy5\WINDOWS\System32\config\SOFTWARE (TM: {741e4949-a764-11f0-a0cf-507b9da345ea}, RM: {741e4948-a764-11f0-a0cf-507b9da345ea}) finished with result=0xC00000A2 (Internal code=7). 

Event[6022]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-12T17:56:42.4200000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[6023]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-12T18:10:11.5420000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[6024]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-12T18:27:15.5490000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[6025]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-12T18:44:19.5570000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[6026]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-12T19:01:23.5670000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[6027]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-12T19:07:01.0130000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[6028]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-12T19:17:11.6930000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 and APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (S-1-15-2-599532750-2870396208-2238781527-566596804-636542555-2629126015-667114179). This security permission can be modified using the Component Services administrative tool. 

Event[6029]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-12T19:17:28.2010000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 and APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (S-1-15-2-730234800-2015962746-1382195008-1183614787-2603024931-3625580009-1103765469). This security permission can be modified using the Component Services administrative tool. 

Event[6030]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-12T19:43:09.7480000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 and APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (S-1-15-2-82072199-2623829752-3834022208-3666678347-3447095474-3570618501-573904199). This security permission can be modified using the Component Services administrative tool. 

Event[6031]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-12T19:47:43.9500000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 and APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (S-1-15-2-3209065543-2094966973-3209876960-2819731020-1727967961-2068342128-3379898698). This security permission can be modified using the Component Services administrative tool. 

Event[6032]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-12T19:48:23.6060000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 and APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (S-1-15-2-2785113275-91670640-2545224065-2502575738-2707567736-890866197-3034652823). This security permission can be modified using the Component Services administrative tool. 

Event[6033]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-12T20:16:50.7140000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[6034]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-12T20:17:41.8100000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 and APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (S-1-15-2-1733307879-326308247-1845270780-3381027743-4033560102-1405302757-3526771488). This security permission can be modified using the Component Services administrative tool. 

Event[6035]
  Log Name: System
  Source: User32
  Date: 2025-10-12T20:22:20.8250000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[6036]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-12T20:22:21.5840000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[6037]
  Log Name: System
  Source: EventLog
  Date: 2025-10-12T20:22:22.0130000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[6038]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-12T20:22:21.9240000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[6039]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-12T20:22:22.0040000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[6040]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-12T20:22:22.0040000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[6041]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-12T20:22:22.0070000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[6042]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-12T20:22:22.0070000Z
  Event ID: 51057
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service stop is almost done.DHCP Context Ref count is 1 

Event[6043]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-12T20:22:22.0110000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[6044]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-12T20:22:22.0150000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[6045]
  Log Name: System
  Source: EventLog
  Date: 2025-10-13T07:46:43.0640000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[6046]
  Log Name: System
  Source: EventLog
  Date: 2025-10-13T07:46:43.0640000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[6047]
  Log Name: System
  Source: EventLog
  Date: 2025-10-13T07:46:43.0650000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 9 seconds. 

Event[6048]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-12T20:22:22.7340000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[6049]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-12T20:22:22.7600000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[6050]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-12T20:22:22.7860000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[6051]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-12T20:22:22.9340000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[6052]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-12T20:22:22.9340000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[6053]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-12T20:22:25.1820000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[6054]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-12T20:22:25.3740000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?12T16:22:25.374596400Z. 

Event[6055]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:34.2010000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?13T03:46:33.500000000Z. 

Event[6056]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:34.2010000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?13T03:46:33.500000000Z. 

Loader time: ?2025?-?10?-?13T03:46:32.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[6057]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-13T07:46:34.2020000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[6058]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-13T07:46:34.2020000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[6059]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-13T07:46:34.2020000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[6060]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-13T07:46:34.2020000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[6061]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-13T07:46:34.2020000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[6062]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-13T07:46:34.2020000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?13T09:16:32.000000000Z. 

Event[6063]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-13T07:46:34.2020000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[6064]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-13T07:46:34.2020000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[6065]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-13T07:46:34.2050000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[6066]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:34.2050000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[6067]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-13T07:46:34.2260000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[6068]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-13T07:46:34.3680000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[6069]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T07:46:34.5820000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T06:59:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6070]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T07:46:34.5830000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T08:28:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6071]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T07:46:34.5840000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T15:27:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6072]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-13T07:46:35.0690000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[6073]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T07:46:35.2280000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T03:37:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6074]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T07:46:35.2340000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T04:12:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6075]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T07:46:35.4590000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T14:43:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6076]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-13T07:46:35.5280000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[6077]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-13T07:46:35.5280000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[6078]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-13T07:46:35.5350000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[6079]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:35.5460000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \SystemRoot\System32\Config\SECURITY was cleared updating 92 keys and creating 4 modified pages. 

Event[6080]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:35.5480000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \SystemRoot\System32\Config\SAM was cleared updating 57 keys and creating 6 modified pages. 

Event[6081]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:35.5790000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \SystemRoot\System32\Config\DEFAULT was cleared updating 756 keys and creating 105 modified pages. 

Event[6082]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-13T07:46:36.7360000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[6083]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T07:46:36.7780000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6084]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T07:46:36.7890000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6085]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T07:46:36.7900000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6086]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T07:46:36.7910000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6087]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T07:46:36.7930000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6088]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T07:46:36.8010000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6089]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T07:46:36.8030000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6090]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-13T07:46:36.8210000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[6091]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T07:46:36.8300000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6092]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-13T07:46:36.8350000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[6093]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:36.8430000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \Device\HarddiskVolume1\EFI\Microsoft\Boot\BCD was cleared updating 73 keys and creating 6 modified pages. 

Event[6094]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-13T07:46:36.8880000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[6095]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-13T07:46:36.8880000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[6096]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-13T07:46:37.4420000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[6097]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:37.5840000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \Device\HarddiskVolume1\EFI\Microsoft\Boot\BCD was cleared updating 73 keys and creating 6 modified pages. 

Event[6098]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:37.6380000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \Device\HarddiskVolume1\EFI\Microsoft\Boot\BCD was cleared updating 73 keys and creating 6 modified pages. 

Event[6099]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-13T07:46:37.6540000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[6100]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:37.6720000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \Device\HarddiskVolume1\EFI\Microsoft\Boot\BCD was cleared updating 73 keys and creating 6 modified pages. 

Event[6101]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:37.6750000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \Device\HarddiskVolume1\EFI\Microsoft\Boot\BCD was cleared updating 73 keys and creating 6 modified pages. 

Event[6102]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:37.6770000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \Device\HarddiskVolume1\EFI\Microsoft\Boot\BCD was cleared updating 73 keys and creating 6 modified pages. 

Event[6103]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:39.2700000Z
  Event ID: 15
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Hive \SystemRoot\System32\Config\SOFTWARE was reorganized with a starting size of 125427712 bytes and an ending size of 123629568 bytes. 

Event[6104]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:39.3030000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[6105]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:39.3100000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \Device\HarddiskVolume1\EFI\Microsoft\Boot\BCD was cleared updating 73 keys and creating 6 modified pages. 

Event[6106]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-13T07:46:41.6240000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[6107]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-13T07:46:41.6240000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[6108]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-13T07:46:41.6240000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[6109]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-13T07:46:41.6260000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[6110]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-13T07:46:41.7230000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[6111]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-13T07:46:41.7240000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[6112]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-13T07:46:41.7730000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[6113]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-13T07:46:41.9530000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[6114]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-13T07:46:41.9640000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[6115]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-13T07:46:41.9640000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[6116]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:42.5840000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\WINDOWS\ServiceProfiles\NetworkService\NTUSER.DAT was cleared updating 157 keys and creating 18 modified pages. 

Event[6117]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:42.7930000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \SystemRoot\System32\Config\BBI was cleared updating 264 keys and creating 68 modified pages. 

Event[6118]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:42.8260000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\WINDOWS\ServiceProfiles\LocalService\NTUSER.DAT was cleared updating 175 keys and creating 22 modified pages. 

Event[6119]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T07:46:42.9030000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T19:19:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6120]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T07:46:42.9140000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T20:28:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6121]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T07:46:42.9240000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T07:32:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6122]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T07:46:42.9430000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T16:57:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6123]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T07:46:42.9620000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6124]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T07:46:42.9620000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T02:55:34.000000000Z) unloaded successfully. 

Event[6125]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T07:46:42.9620000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T02:55:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6126]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T07:46:42.9680000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T16:31:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6127]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T07:46:42.9750000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T16:17:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6128]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T07:46:42.9830000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T09:23:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6129]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-13T07:46:43.3410000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[6130]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-13T07:46:43.3410000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[6131]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-13T07:46:43.3410000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[6132]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-13T07:46:43.3740000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[6133]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:43.5380000Z
  Event ID: 15
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Hive \SystemRoot\System32\config\DRIVERS was reorganized with a starting size of 8482816 bytes and an ending size of 8478720 bytes. 

Event[6134]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-13T07:46:43.5750000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[6135]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T07:46:43.6230000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6136]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T07:46:43.6230000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6137]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T07:46:43.6230000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6138]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T07:46:43.6230000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6139]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T07:46:43.6230000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6140]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T07:46:43.6230000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6141]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T07:46:43.6230000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6142]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T07:46:43.6230000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6143]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T07:46:43.6230000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6144]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T07:46:43.6230000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6145]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T07:46:43.6230000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6146]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T07:46:43.6230000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6147]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T07:46:43.6230000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6148]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T07:46:43.6230000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6149]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-13T07:46:44.0060000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[6150]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:44.0460000Z
  Event ID: 15
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Hive \??\C:\Users\aaron\ntuser.dat was reorganized with a starting size of 15601664 bytes and an ending size of 15437824 bytes. 

Event[6151]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:44.0990000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Microsoft\Windows\UsrClass.dat was cleared updating 3337 keys and creating 536 modified pages. 

Event[6152]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-13T07:46:45.8550000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[6153]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-13T07:46:45.8550000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000046-0000000000.json for detailed information on what checks were made. 

Event[6154]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-13T07:46:46.2120000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[6155]
  Log Name: System
  Source: TPM
  Date: 2025-10-13T07:46:46.2140000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[6156]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-13T07:46:46.3400000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[6157]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:46.3620000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\WINDOWS\AppCompat\Programs\Amcache.hve was cleared updating 2273 keys and creating 768 modified pages. 

Event[6158]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-13T07:46:46.4010000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[6159]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:48.8040000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\settings.dat was cleared updating 17 keys and creating 5 modified pages. 

Event[6160]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:48.8860000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\User.dat was cleared updating 18 keys and creating 3 modified pages. 

Event[6161]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:48.8900000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\SystemAppData\Helium\UserClasses.dat was cleared updating 13 keys and creating 1 modified pages. 

Event[6162]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:49.6340000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\settings.dat was cleared updating 16 keys and creating 1 modified pages. 

Event[6163]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-13T07:46:49.8050000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[6164]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:50.2360000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\MicrosoftWindows.Client.WebExperience_cw5n1h2txyewy\Settings\settings.dat was cleared updating 6 keys and creating 1 modified pages. 

Event[6165]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:50.3130000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat was cleared updating 5 keys and creating 1 modified pages. 

Event[6166]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-13T07:46:51.0830000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[6167]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-13T07:46:52.6180000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[6168]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:46:52.9490000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages. 

Event[6169]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:47:27.6500000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 17 keys and creating 4 modified pages. 

Event[6170]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:47:32.5340000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\dosvcState.dat was cleared updating 8 keys and creating 5 modified pages. 

Event[6171]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:47:32.9280000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat was cleared updating 254 keys and creating 20 modified pages. 

Event[6172]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T07:47:47.9460000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6173]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T07:47:47.9460000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6174]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T07:47:47.9620000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6175]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T07:47:47.9620000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6176]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T07:47:47.9620000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6177]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T07:47:47.9620000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6178]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T07:47:47.9620000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6179]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T07:47:47.9620000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6180]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-13T07:48:33.5100000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[6181]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-13T07:48:47.4940000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6182]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-13T07:48:47.4940000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6183]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:49:33.0080000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\SystemAppData\Helium\User.dat was cleared updating 7 keys and creating 1 modified pages. 

Event[6184]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T07:49:33.0140000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat was cleared updating 11 keys and creating 3 modified pages. 

Event[6185]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-13T07:50:43.7740000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[6186]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-13T07:51:43.5570000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[6187]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-13T07:51:43.5570000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[6188]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T07:51:54.4580000Z
  Event ID: 111
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events triggered on a URL group, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
Create URL group 0xFF00000620000001. Status 0x0. Process Id 0x1058 Executable path \Device\HarddiskVolume3\Users\aaron\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\LSB.exe, User S-1-5-21-1511219319-3122627625-3827747853-1001 

Event[6189]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T07:51:54.4590000Z
  Event ID: 113
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events triggered on a URL group, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
Attempted to add URL (http://localhost:50128/) to URL group (0xFF00000620000001). Status: 0x0. Process Id 0x1058 Executable path \Device\HarddiskVolume3\Users\aaron\AppData\Local\Programs\Lenovo\Lenovo Service Bridge\LSB.exe, User S-1-5-21-1511219319-3122627625-3827747853-1001 

Event[6190]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-13T07:52:47.1560000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 and APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (S-1-15-2-360016945-3187745333-1787372542-461640750-1228998284-4162973896-2771188635). This security permission can be modified using the Component Services administrative tool. 

Event[6191]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-13T07:53:34.4340000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6192]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-13T07:53:34.4360000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6193]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-13T07:53:34.4360000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6194]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-13T07:53:34.4380000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6195]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-13T07:57:19.1190000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[6196]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-13T07:57:19.1190000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.439.129.0) - Current Channel (Broad) 

Event[6197]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-13T07:57:30.1020000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.439.129.0) - Current Channel (Broad) 

Event[6198]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-13T07:58:10.3520000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[6199]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T08:03:22.0870000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\SystemAppData\Helium\User.dat was cleared updating 36 keys and creating 4 modified pages. 

Event[6200]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T08:03:22.0940000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat was cleared updating 17 keys and creating 3 modified pages. 

Event[6201]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T08:03:22.1010000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\26e997904203b5ad_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[6202]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T08:03:22.2950000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 12 keys and creating 5 modified pages. 

Event[6203]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T08:03:47.5670000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Paint_8wekyb3d8bbwe\SystemAppData\Helium\User.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[6204]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T08:03:47.5720000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Paint_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[6205]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T08:03:47.5780000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\Microsoft.Paint_8wekyb3d8bbwe\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\f9c42b95aceead9_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[6206]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-13T08:08:51.3440000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Time service was changed from demand start to disabled. 

Event[6207]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-13T08:08:53.1950000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Time service was changed from disabled to demand start. 

Event[6208]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-13T08:08:53.2380000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[6209]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-13T08:08:54.8890000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->40.81.94.65:123). 

Event[6210]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T08:09:01.9800000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[6211]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T08:09:01.9800000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?13T04:09:01.980394000Z from ?2025?-?10?-?13T04:08:54.894750700Z.
Time Delta: 7085 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 2992).

RTC time: ?2025?-?10?-?13T09:39:01.980394000Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6212]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-13T08:09:01.9810000Z
  Event ID: 35
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time service is now synchronizing the system time with the time source time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->40.81.94.65:123) with reference id 1096700200. Current local stratum number is 4. 

Event[6213]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T08:09:01.9810000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -330. 

Event[6214]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T08:09:01.9810000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?13T04:09:01.981129700Z from ?2025?-?10?-?13T04:09:01.980394000Z.
Time Delta: 0 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 2992).

RTC time: ?2025?-?10?-?13T09:39:01.981129700Z
Current time zone bias: -330
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6215]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-13T08:09:03.5580000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[6216]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T08:09:37.2270000Z
  Event ID: 22
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The time zone bias has changed to -240 from -330. 

Event[6217]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T08:09:37.2280000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -240. 

Event[6218]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T08:09:37.2280000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?13T04:09:37.225034100Z from ?2025?-?10?-?13T04:09:37.225034100Z.
Time Delta: 0 ms

Change Reason: System time adjusted to the new time zone.
Process: '\Device\HarddiskVolume3\Windows\ImmersiveControlPanel\SystemSettings.exe' (PID 2000).

RTC time: ?2025?-?10?-?13T08:09:37.225034100Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6219]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-13T08:12:18.7790000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6220]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-13T08:26:07.5720000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[6221]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-13T08:30:17.3400000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 and APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (S-1-15-2-810749011-3661287782-98741444-1831234189-367980840-3465614166-1948897259). This security permission can be modified using the Component Services administrative tool. 

Event[6222]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-13T08:43:11.5850000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[6223]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-13T08:53:38.0800000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 and APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (S-1-15-2-3484258932-4234014105-2911871632-2087827226-455703916-602076973-3028149860). This security permission can be modified using the Component Services administrative tool. 

Event[6224]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-13T09:00:15.5920000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[6225]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-13T09:06:48.2660000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[6226]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-13T09:12:07.4920000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[6227]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T09:16:09.5380000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[6228]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-13T09:17:19.6060000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[6229]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-13T09:57:16.9440000Z
  Event ID: 7012
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7012 - radio OFF 

Event[6230]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-13T09:57:57.2420000Z
  Event ID: 7011
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7011 - radio ON 

Event[6231]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-13T10:08:53.3080000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[6232]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-13T10:31:24.8230000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 and APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (S-1-15-2-2662929535-3302920141-2927143294-1928063825-2721095440-1592609294-1705728685). This security permission can be modified using the Component Services administrative tool. 

Event[6233]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-13T10:59:42.9940000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  Alps Pointing-device Filter Driver
Service File Name:  \SystemRoot\system32\DRIVERS\Apfiltr.sys
Service Type:  kernel mode driver
Service Start Type:  demand start
Service Account:   

Event[6234]
  Log Name: System
  Source: Microsoft-Windows-UserPnp
  Date: 2025-10-13T10:59:43.0010000Z
  Event ID: 20003
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Driver Management has concluded the process to add Service ApfiltrService for Device Instance ID ACPI\AUI1635\4&2B3AD87C&0 with the following status: 0. 

Event[6235]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-13T10:59:43.0030000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  Alps HID Monitor Service
Service File Name:  C:\Program Files\Apoint2K\HidMonitorSvc.exe
Service Type:  user mode service
Service Start Type:  auto start
Service Account:  LocalSystem 

Event[6236]
  Log Name: System
  Source: Microsoft-Windows-UserPnp
  Date: 2025-10-13T10:59:43.0080000Z
  Event ID: 20003
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Driver Management has concluded the process to add Service ApHidMonitorService for Device Instance ID ACPI\AUI1635\4&2B3AD87C&0 with the following status: 0. 

Event[6237]
  Log Name: System
  Source: Microsoft-Windows-UserPnp
  Date: 2025-10-13T10:59:43.0150000Z
  Event ID: 20003
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Driver Management has concluded the process to add Service mouclass for Device Instance ID ACPI\AUI1635\4&2B3AD87C&0 with the following status: 0. 

Event[6238]
  Log Name: System
  Source: Microsoft-Windows-UserPnp
  Date: 2025-10-13T10:59:43.0210000Z
  Event ID: 20003
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Driver Management has concluded the process to add Service i8042prt for Device Instance ID ACPI\AUI1635\4&2B3AD87C&0 with the following status: 0. 

Event[6239]
  Log Name: System
  Source: User32
  Date: 2025-10-13T11:01:29.4110000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the restart of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: restart
 Comment:  

Event[6240]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-13T11:01:30.3590000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[6241]
  Log Name: System
  Source: EventLog
  Date: 2025-10-13T11:01:30.9830000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[6242]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-13T11:01:30.9170000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[6243]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T11:01:30.9690000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -240. 

Event[6244]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T11:01:30.9690000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?13T07:01:30.969446800Z from ?2025?-?10?-?13T07:01:30.953683600Z.
Time Delta: 15 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 2992).

RTC time: ?2025?-?10?-?13T11:01:30.969446800Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6245]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-13T11:01:30.9760000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[6246]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-13T11:01:30.9760000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[6247]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-13T11:01:30.9770000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[6248]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-13T11:01:30.9780000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[6249]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-13T11:01:30.9780000Z
  Event ID: 51057
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service stop is almost done.DHCP Context Ref count is 1 

Event[6250]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-13T11:01:30.9790000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[6251]
  Log Name: System
  Source: EventLog
  Date: 2025-10-13T11:01:45.8380000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[6252]
  Log Name: System
  Source: EventLog
  Date: 2025-10-13T11:01:45.8380000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[6253]
  Log Name: System
  Source: EventLog
  Date: 2025-10-13T11:01:45.8390000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[6254]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-13T11:01:31.6900000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[6255]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-13T11:01:31.7100000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[6256]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-13T11:01:31.7200000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Reboot 
Event Code: 0x0 
Reason: Kernel API 

Event[6257]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-13T11:01:31.9180000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[6258]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-13T11:01:31.9180000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[6259]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-13T11:01:34.2880000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[6260]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T11:01:34.4840000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?13T07:01:34.484556500Z. 

Event[6261]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T11:01:40.9090000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?13T07:01:40.500000000Z. 

Event[6262]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T11:01:40.9090000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?13T07:01:40.500000000Z. 

Loader time: ?2025?-?10?-?13T07:01:39.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[6263]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-13T11:01:40.9090000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[6264]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-13T11:01:40.9090000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[6265]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-13T11:01:40.9090000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[6266]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-13T11:01:40.9100000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[6267]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-13T11:01:40.9100000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[6268]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-13T11:01:40.9100000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?13T11:01:39.000000000Z. 

Event[6269]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-13T11:01:40.9100000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[6270]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-13T11:01:40.9100000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[6271]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-13T11:01:40.9140000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[6272]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T11:01:40.9140000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[6273]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-13T11:01:40.9510000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[6274]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-13T11:01:41.1150000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[6275]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T11:01:41.3220000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T05:29:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6276]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T11:01:41.3230000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T06:58:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6277]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T11:01:41.3240000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T13:57:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6278]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-13T11:01:41.7610000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[6279]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T11:01:41.8490000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T02:07:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6280]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T11:01:41.8550000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T02:42:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6281]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T11:01:41.9630000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T13:13:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6282]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-13T11:01:41.9960000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[6283]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-13T11:01:41.9960000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[6284]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-13T11:01:41.9990000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[6285]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-13T11:01:42.5220000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[6286]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T11:01:42.5640000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6287]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T11:01:42.5730000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6288]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T11:01:42.5850000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6289]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T11:01:42.5960000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6290]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T11:01:42.5980000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6291]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T11:01:42.5990000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6292]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T11:01:42.6000000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6293]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-13T11:01:42.6040000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[6294]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T11:01:42.6140000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6295]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-13T11:01:42.6190000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[6296]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-13T11:01:42.6790000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[6297]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-13T11:01:43.1340000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[6298]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-13T11:01:43.3020000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[6299]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T11:01:43.3750000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -240. 

Event[6300]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-13T11:01:44.3880000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[6301]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-13T11:01:44.3880000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[6302]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-13T11:01:44.3880000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[6303]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-13T11:01:44.3890000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[6304]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-13T11:01:44.4830000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[6305]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-13T11:01:44.4840000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[6306]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-13T11:01:44.5360000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[6307]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-13T11:01:44.7160000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[6308]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-13T11:01:44.7390000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[6309]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-13T11:01:44.7390000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[6310]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T11:01:45.6910000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T18:58:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6311]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T11:01:45.7020000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T06:02:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6312]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T11:01:45.7090000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T17:49:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6313]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T11:01:45.7200000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T15:27:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6314]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T11:01:45.7380000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6315]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T11:01:45.7380000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T01:25:34.000000000Z) unloaded successfully. 

Event[6316]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T11:01:45.7380000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6317]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T11:01:45.7440000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T15:01:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6318]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T11:01:45.7510000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T14:47:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6319]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T11:01:45.7600000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T07:53:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6320]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-13T11:01:46.1320000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[6321]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-13T11:01:46.1320000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[6322]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-13T11:01:46.1320000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[6323]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-13T11:01:46.1650000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[6324]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-13T11:01:46.3360000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[6325]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T11:01:46.3470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6326]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T11:01:46.3470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6327]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T11:01:46.3470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6328]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T11:01:46.3470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6329]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T11:01:46.3470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6330]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T11:01:46.3470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6331]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T11:01:46.3470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6332]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T11:01:46.3470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6333]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T11:01:46.3470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6334]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T11:01:46.3470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6335]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T11:01:46.3470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6336]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T11:01:46.3470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6337]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T11:01:46.3470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6338]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-13T11:01:46.3470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6339]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-13T11:01:46.7490000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[6340]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-13T11:01:48.3750000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[6341]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-13T11:01:48.3760000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000047-0000000000.json for detailed information on what checks were made. 

Event[6342]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-13T11:01:48.5790000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[6343]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-13T11:01:48.6160000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[6344]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-13T11:01:54.5190000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[6345]
  Log Name: System
  Source: TPM
  Date: 2025-10-13T11:01:54.5230000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[6346]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-13T11:01:55.8960000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[6347]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-13T11:01:56.5930000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[6348]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T11:02:53.7230000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6349]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T11:02:53.7390000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6350]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T11:02:53.7550000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6351]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T11:02:53.7550000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6352]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T11:02:53.7550000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6353]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T11:02:53.7710000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6354]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T11:02:53.7710000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6355]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-13T11:02:53.7710000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6356]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-13T11:03:56.3810000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6357]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-13T11:03:56.3810000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6358]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-13T11:03:56.3830000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6359]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-13T11:06:46.4790000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[6360]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-13T11:06:46.4790000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[6361]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-13T11:12:14.0940000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[6362]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-13T11:12:14.0940000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.439.132.0) - Current Channel (Broad) 

Event[6363]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-13T11:12:24.7850000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.439.132.0) - Current Channel (Broad) 

Event[6364]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-13T11:17:56.6970000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 and APPID 
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (S-1-15-2-1926592998-3929652130-1048040641-220448394-4079308347-3592623427-1737240038). This security permission can be modified using the Component Services administrative tool. 

Event[6365]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-13T11:17:58.3770000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6366]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-13T11:17:58.3810000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6367]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-13T11:17:58.3810000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6368]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-13T11:17:58.3830000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6369]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-13T11:22:41.7710000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6370]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-13T11:22:50.9790000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'dbx' (6.1, ?2019?-?02?-?11T20:39:19.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6371]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T11:30:17.9750000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[6372]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-13T11:57:10.1620000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6373]
  Log Name: System
  Source: EventLog
  Date: 2025-10-13T12:00:00.8520000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 3500 seconds. 

Event[6374]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-13T12:26:14.3860000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[6375]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-13T12:28:18.6010000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[6376]
  Log Name: System
  Source: Volsnap
  Date: 2025-10-13T12:58:45.9280000Z
  Event ID: 33
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The oldest shadow copy of volume C: was deleted to keep disk space usage for shadow copies of volume C: below the user defined limit. 

Event[6377]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-13T12:58:46.1750000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume ?? (\Device\HarddiskVolumeShadowCopy7) is healthy.  No action is needed. 

Event[6378]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-13T13:02:03.3800000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name mobile.events.data.microsoft.com timed out after none of the configured DNS servers responded. Client PID 3724. 

Event[6379]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-13T14:25:29.4470000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[6380]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T14:32:06.4380000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 2 keys and creating 1 modified pages. 

Event[6381]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T17:03:49.4030000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 2 keys and creating 1 modified pages. 

Event[6382]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-13T17:04:00.2440000Z
  Event ID: 187
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
User-mode process attempted to change the system state by calling SetSuspendState or SetSystemPowerState APIs. 

Event[6383]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-13T17:04:00.2590000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 0 to 1.

Reason ScreenOffGracePeriod 

BootId: 47 

Event[6384]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-13T17:04:00.9230000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: Application API 

Event[6385]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-13T17:04:02.6570000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[6386]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T17:04:05.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?13T13:04:05.500000000Z from ?2025?-?10?-?13T13:04:02.657828200Z.
Time Delta: 2842 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?13T17:04:05.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6387]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-13T17:04:05.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 1, FullResume: 705, AverageResume: 705 

Event[6388]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-13T17:04:05.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 21741442, SuspendEnd: 21741442 

Event[6389]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-13T17:04:05.6730000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 1 to 2.

Reason SxTransition 

BootId: 47 

Event[6390]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-13T17:04:06.3440000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 2 to 4.

Reason Unknown 

BootId: 47 

Event[6391]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-13T17:04:06.7640000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?13T13:04:00.243415700Z
Wake Time: ?2025?-?10?-?13T13:04:05.676317500Z

Wake Source: Power Button 

Event[6392]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-13T17:04:08.2790000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[6393]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-13T17:06:13.0610000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[6394]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-13T17:23:09.0850000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[6395]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-13T17:25:13.2690000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[6396]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-13T17:25:56.9810000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[6397]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-13T17:28:01.6940000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[6398]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-13T18:24:31.8710000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name www.msftconnecttest.com timed out after none of the configured DNS servers responded. Client PID 1052. 

Event[6399]
  Log Name: System
  Source: User32
  Date: 2025-10-13T18:48:43.5210000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[6400]
  Log Name: System
  Source: EventLog
  Date: 2025-10-13T18:48:45.6250000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[6401]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-13T18:48:45.0470000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[6402]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-13T18:48:45.5530000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[6403]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-13T18:48:45.6090000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[6404]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-13T18:48:45.6110000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[6405]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-13T18:48:45.6160000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[6406]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-13T18:48:45.6160000Z
  Event ID: 51057
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service stop is almost done.DHCP Context Ref count is 1 

Event[6407]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-13T18:48:45.6230000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[6408]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-13T18:48:45.6230000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[6409]
  Log Name: System
  Source: EventLog
  Date: 2025-10-14T07:11:44.7570000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[6410]
  Log Name: System
  Source: EventLog
  Date: 2025-10-14T07:11:44.7580000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[6411]
  Log Name: System
  Source: EventLog
  Date: 2025-10-14T07:11:44.7580000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 6 seconds. 

Event[6412]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-13T18:48:46.3390000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[6413]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-13T18:48:46.3550000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[6414]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-13T18:48:46.3650000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[6415]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-13T18:48:46.5680000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[6416]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-13T18:48:46.5680000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[6417]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-13T18:48:48.9140000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[6418]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-13T18:48:49.1140000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?13T14:48:49.114337000Z. 

Event[6419]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T07:11:38.8970000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?14T03:11:38.500000000Z. 

Event[6420]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T07:11:38.8970000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?14T03:11:38.500000000Z. 

Loader time: ?2025?-?10?-?14T03:11:38.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[6421]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-14T07:11:38.8980000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[6422]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-14T07:11:38.8980000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[6423]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-14T07:11:38.8980000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[6424]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-14T07:11:38.8980000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[6425]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-14T07:11:38.8980000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[6426]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-14T07:11:38.8980000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?14T07:11:38.000000000Z. 

Event[6427]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-14T07:11:38.8980000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[6428]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-14T07:11:38.8980000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[6429]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-14T07:11:38.9020000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[6430]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T07:11:38.9020000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[6431]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-14T07:11:38.9330000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[6432]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-14T07:11:39.0830000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[6433]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:11:39.3040000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T05:29:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6434]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:11:39.3050000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T06:58:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6435]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:11:39.3060000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T13:57:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6436]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-14T07:11:39.7100000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[6437]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:11:39.8950000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T02:07:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6438]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:11:39.9030000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T02:42:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6439]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:11:40.1340000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T13:13:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6440]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T07:11:40.2010000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[6441]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T07:11:40.2010000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[6442]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T07:11:40.2040000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[6443]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-14T07:11:41.2540000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[6444]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:11:41.2970000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6445]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:11:41.3060000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6446]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:11:41.3070000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6447]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:11:41.3090000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6448]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:11:41.3100000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6449]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:11:41.3110000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6450]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:11:41.3190000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6451]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-14T07:11:41.3360000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[6452]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:11:41.4560000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6453]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T07:11:41.5030000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[6454]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T07:11:41.5810000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[6455]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-14T07:11:42.1750000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[6456]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-14T07:11:42.3800000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[6457]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T07:11:42.4520000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -240. 

Event[6458]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-14T07:11:43.1890000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[6459]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-14T07:11:43.1890000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[6460]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-14T07:11:43.1890000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[6461]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-14T07:11:43.1900000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[6462]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-14T07:11:43.2980000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[6463]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-14T07:11:43.3000000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[6464]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-14T07:11:43.3530000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[6465]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-14T07:11:43.5280000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[6466]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-14T07:11:43.5400000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[6467]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-14T07:11:43.5400000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[6468]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:11:44.5650000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T18:58:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6469]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:11:44.5770000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T06:02:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6470]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:11:44.5830000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T17:49:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6471]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:11:44.6090000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T15:27:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6472]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:11:44.6310000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6473]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:11:44.6310000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T01:25:34.000000000Z) unloaded successfully. 

Event[6474]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:11:44.6310000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6475]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:11:44.6360000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T15:01:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6476]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:11:44.6510000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T14:47:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6477]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:11:44.6640000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T07:53:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6478]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-14T07:11:45.0180000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[6479]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-14T07:11:45.0190000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[6480]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-14T07:11:45.0190000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[6481]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-14T07:11:45.0410000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[6482]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:11:45.2320000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6483]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:11:45.2320000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6484]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:11:45.2320000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6485]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:11:45.2320000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6486]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:11:45.2320000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6487]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:11:45.2320000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6488]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:11:45.2320000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6489]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:11:45.2320000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6490]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:11:45.2320000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6491]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:11:45.2320000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6492]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:11:45.2330000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6493]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:11:45.2330000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6494]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:11:45.2330000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6495]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:11:45.2330000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6496]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-14T07:11:45.6840000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[6497]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-14T07:11:47.5240000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[6498]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-14T07:11:48.2540000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[6499]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-14T07:11:48.2540000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000048-0000000000.json for detailed information on what checks were made. 

Event[6500]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-14T07:11:48.3920000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[6501]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-14T07:11:48.5340000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[6502]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-14T07:11:48.5740000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[6503]
  Log Name: System
  Source: TPM
  Date: 2025-10-14T07:11:49.2110000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[6504]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-14T07:11:51.9500000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[6505]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-14T07:11:53.6100000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[6506]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:12:52.4650000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6507]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:12:52.4650000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6508]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:12:52.4650000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6509]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:12:52.4650000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6510]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:12:52.4650000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6511]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:12:52.4650000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6512]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:12:52.4810000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6513]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:12:52.4970000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6514]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-14T07:13:50.0290000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6515]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-14T07:13:50.0290000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6516]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-14T07:13:50.0290000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6517]
  Log Name: System
  Source: User32
  Date: 2025-10-14T07:13:57.7630000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the restart of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: restart
 Comment:  

Event[6518]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-14T07:13:58.4730000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[6519]
  Log Name: System
  Source: EventLog
  Date: 2025-10-14T07:13:59.9970000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[6520]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-14T07:13:59.9210000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[6521]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-14T07:13:59.9890000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[6522]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-14T07:13:59.9890000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[6523]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-14T07:13:59.9900000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[6524]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-14T07:13:59.9900000Z
  Event ID: 51057
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service stop is almost done.DHCP Context Ref count is 1 

Event[6525]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-14T07:13:59.9930000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[6526]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-14T07:13:59.9990000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[6527]
  Log Name: System
  Source: EventLog
  Date: 2025-10-14T07:14:13.7620000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[6528]
  Log Name: System
  Source: EventLog
  Date: 2025-10-14T07:14:13.7630000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[6529]
  Log Name: System
  Source: EventLog
  Date: 2025-10-14T07:14:13.7640000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[6530]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-14T07:14:00.6960000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[6531]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-14T07:14:00.7520000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[6532]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T07:14:00.7670000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Reboot 
Event Code: 0x0 
Reason: Kernel API 

Event[6533]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-14T07:14:00.9370000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[6534]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-14T07:14:00.9370000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[6535]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T07:14:01.0810000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[6536]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T07:14:01.4440000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?14T03:14:01.444546400Z. 

Event[6537]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T07:14:08.8960000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?14T03:14:08.500000000Z. 

Event[6538]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T07:14:08.8960000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?14T03:14:08.500000000Z. 

Loader time: ?2025?-?10?-?14T03:14:07.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[6539]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-14T07:14:08.8970000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[6540]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-14T07:14:08.8970000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[6541]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-14T07:14:08.8970000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[6542]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-14T07:14:08.8970000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[6543]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-14T07:14:08.8970000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[6544]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-14T07:14:08.8970000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?14T07:14:07.000000000Z. 

Event[6545]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-14T07:14:08.8970000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[6546]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-14T07:14:08.8970000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[6547]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-14T07:14:08.9010000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[6548]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T07:14:08.9010000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[6549]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-14T07:14:08.9490000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[6550]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-14T07:14:09.1120000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[6551]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:14:09.3340000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T05:29:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6552]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:14:09.3350000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T06:58:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6553]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:14:09.3370000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T13:57:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6554]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-14T07:14:09.6880000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[6555]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:14:09.7840000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T02:07:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6556]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:14:09.7890000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T02:42:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6557]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:14:09.8990000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T13:13:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6558]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T07:14:09.9330000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[6559]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T07:14:09.9330000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[6560]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T07:14:09.9350000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[6561]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-14T07:14:10.4550000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[6562]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:14:10.4970000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6563]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:14:10.5240000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6564]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:14:10.5250000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6565]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:14:10.5260000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6566]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:14:10.5270000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6567]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:14:10.5280000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6568]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:14:10.5300000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6569]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:14:10.5310000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[6570]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T07:14:10.5350000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[6571]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-14T07:14:10.5370000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[6572]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T07:14:10.5930000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[6573]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-14T07:14:11.0770000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[6574]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-14T07:14:11.2780000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[6575]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T07:14:11.3540000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -240. 

Event[6576]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-14T07:14:12.2860000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[6577]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-14T07:14:12.2860000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[6578]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-14T07:14:12.2860000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[6579]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-14T07:14:12.2880000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[6580]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-14T07:14:12.3940000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[6581]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-14T07:14:12.3960000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[6582]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-14T07:14:12.4560000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[6583]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-14T07:14:12.6480000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[6584]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-14T07:14:12.6610000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[6585]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-14T07:14:12.6610000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[6586]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:14:13.6110000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T18:58:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6587]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:14:13.6210000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T06:02:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6588]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:14:13.6310000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T17:49:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6589]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:14:13.6390000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T15:27:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6590]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:14:13.6580000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6591]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:14:13.6580000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T01:25:34.000000000Z) unloaded successfully. 

Event[6592]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:14:13.6580000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6593]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:14:13.6640000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T15:01:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6594]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:14:13.6740000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T14:47:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6595]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-14T07:14:13.6820000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T07:53:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[6596]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-14T07:14:14.0220000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[6597]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-14T07:14:14.0220000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[6598]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-14T07:14:14.0220000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[6599]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-14T07:14:14.0490000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[6600]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:14:14.2310000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6601]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:14:14.2310000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6602]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:14:14.2310000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6603]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:14:14.2310000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6604]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:14:14.2310000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6605]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:14:14.2310000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6606]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:14:14.2310000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6607]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:14:14.2310000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6608]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:14:14.2310000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6609]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:14:14.2310000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6610]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:14:14.2310000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6611]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:14:14.2310000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6612]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:14:14.2310000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6613]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-14T07:14:14.2310000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[6614]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-14T07:14:14.2950000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[6615]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-14T07:14:14.6970000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[6616]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-14T07:14:15.9590000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[6617]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-14T07:14:15.9590000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000049-0000000000.json for detailed information on what checks were made. 

Event[6618]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-14T07:14:16.3420000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[6619]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-14T07:14:16.4720000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[6620]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-14T07:14:16.5170000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[6621]
  Log Name: System
  Source: TPM
  Date: 2025-10-14T07:14:19.2350000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[6622]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-14T07:14:20.3310000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[6623]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-14T07:14:22.7520000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[6624]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:15:21.6670000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6625]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:15:21.6850000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6626]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:15:21.6850000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6627]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:15:21.6850000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6628]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:15:21.6850000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6629]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:15:21.6850000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6630]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:15:21.6850000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6631]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-14T07:15:21.6850000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[6632]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-14T07:16:18.1880000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6633]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-14T07:16:18.1880000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6634]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-14T07:16:18.1880000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6635]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-14T07:17:53.7440000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6636]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-14T07:19:14.2730000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[6637]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-14T07:19:14.2730000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[6638]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-14T07:21:26.5060000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6639]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-14T07:21:26.5090000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6640]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-14T07:21:26.5110000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6641]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-14T07:21:26.5110000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6642]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-14T07:24:48.9990000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[6643]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-14T07:24:48.9990000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.439.153.0) - Current Channel (Broad) 

Event[6644]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-14T07:25:00.9180000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.439.153.0) - Current Channel (Broad) 

Event[6645]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T07:59:46.3750000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[6646]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-14T07:59:49.1500000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[6647]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-14T07:59:49.2950000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->40.81.94.65:123). 

Event[6648]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T07:59:50.6180000Z
  Event ID: 15
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Hive \??\C:\WINDOWS\System32\config\COMPONENTS was reorganized with a starting size of 43216896 bytes and an ending size of 43139072 bytes. 

Event[6649]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T07:59:50.9050000Z
  Event ID: 15
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Hive \??\C:\WINDOWS\System32\SMI\Store\Machine\schema.dat was reorganized with a starting size of 10756096 bytes and an ending size of 10739712 bytes. 

Event[6650]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-14T07:59:51.3590000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from demand start to auto start. 

Event[6651]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-14T08:01:28.4100000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from auto start to demand start. 

Event[6652]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-14T08:01:30.6230000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from demand start to auto start. 

Event[6653]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-14T08:01:31.5010000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from auto start to demand start. 

Event[6654]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-14T08:01:37.7670000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from demand start to auto start. 

Event[6655]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-14T08:03:40.3130000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from auto start to demand start. 

Event[6656]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-14T08:17:09.1670000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[6657]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-14T08:34:13.1730000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[6658]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-14T08:51:17.1800000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[6659]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-14T09:08:20.4240000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[6660]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-14T09:08:21.1860000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[6661]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-14T09:39:57.6570000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name m.stripe.network timed out after none of the configured DNS servers responded. Client PID 3732. 

Event[6662]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-14T10:35:51.2530000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[6663]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-14T11:52:19.7960000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name waa-pa.clients6.google.com timed out after none of the configured DNS servers responded. Client PID 3732. 

Event[6664]
  Log Name: System
  Source: EventLog
  Date: 2025-10-14T12:00:00.7770000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 17152 seconds. 

Event[6665]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-14T12:32:53.3690000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->40.81.94.65:123). 

Event[6666]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T12:33:10.3580000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -240. 

Event[6667]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T12:33:10.3580000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T08:33:10.358472300Z from ?2025?-?10?-?14T08:33:09.282359900Z.
Time Delta: 1076 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 10884).

RTC time: ?2025?-?10?-?14T12:33:10.358472300Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6668]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-14T12:33:10.3590000Z
  Event ID: 35
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time service is now synchronizing the system time with the time source time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->40.81.94.65:123) with reference id 1096700200. Current local stratum number is 4. 

Event[6669]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T12:33:10.3590000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -240. 

Event[6670]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T12:33:10.3590000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T08:33:10.359174600Z from ?2025?-?10?-?14T08:33:10.359187000Z.
Time Delta: 0 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 10884).

RTC time: ?2025?-?10?-?14T12:33:10.359174600Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6671]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T12:33:10.3600000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -240. 

Event[6672]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T12:33:10.3610000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T08:33:10.360662200Z from ?2025?-?10?-?14T08:33:10.360170200Z.
Time Delta: 0 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 10884).

RTC time: ?2025?-?10?-?14T12:33:10.360662200Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6673]
  Log Name: System
  Source: Microsoft-Windows-UserModePowerService
  Date: 2025-10-14T12:39:30.0800000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Process C:\Windows\ImmersiveControlPanel\SystemSettings.exe (process ID:8404) reset policy scheme from {381b4222-f694-41f0-9685-ff5bb260df2e} to {381b4222-f694-41f0-9685-ff5bb260df2e} 

Event[6674]
  Log Name: System
  Source: Microsoft-Windows-UserModePowerService
  Date: 2025-10-14T12:39:53.4920000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Process C:\Windows\ImmersiveControlPanel\SystemSettings.exe (process ID:8404) reset policy scheme from {381b4222-f694-41f0-9685-ff5bb260df2e} to {381b4222-f694-41f0-9685-ff5bb260df2e} 

Event[6675]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-14T13:02:50.8100000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name signaler-pa.clients6.google.com timed out after none of the configured DNS servers responded. Client PID 3732. 

Event[6676]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T13:05:42.6620000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 0 to 1.

Reason SessionUnlock 

BootId: 49 

Event[6677]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T13:06:21.7770000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 1 to 3.

Reason InputHid 

BootId: 49 

Event[6678]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T13:11:31.8930000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 3 to 4.

Reason SessionUnlock 

BootId: 49 

Event[6679]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T13:16:41.3750000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 4 to 6.

Reason SxTransition 

BootId: 49 

Event[6680]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T13:16:44.1520000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[6681]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T13:16:45.3520000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[6682]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T13:16:49.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T09:16:49.500000000Z from ?2025?-?10?-?14T09:16:45.352288900Z.
Time Delta: 4147 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?14T13:16:49.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6683]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T13:16:49.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 1, FullResume: 705, AverageResume: 705 

Event[6684]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T13:16:49.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 21750801, SuspendEnd: 21750802 

Event[6685]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T13:16:49.6740000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 6 to 7.

Reason SxTransition 

BootId: 49 

Event[6686]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T13:16:50.3870000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 7 to 9.

Reason Unknown 

BootId: 49 

Event[6687]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-14T13:16:50.7200000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T09:16:41.364095300Z
Wake Time: ?2025?-?10?-?14T09:16:49.674362500Z

Wake Source: Power Button 

Event[6688]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T13:17:50.4300000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 9 to 10.

Reason SessionUnlock 

BootId: 49 

Event[6689]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T13:27:15.5800000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 10 to 12.

Reason SxTransition 

BootId: 49 

Event[6690]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T13:27:15.9430000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[6691]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T13:27:17.5550000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[6692]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T13:27:21.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T09:27:21.500000000Z from ?2025?-?10?-?14T09:27:17.556109800Z.
Time Delta: 3943 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?14T13:27:21.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6693]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T13:27:21.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 2, FullResume: 692, AverageResume: 698 

Event[6694]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T13:27:21.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 22378607, SuspendEnd: 22378607 

Event[6695]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T13:27:21.6760000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 12 to 13.

Reason SxTransition 

BootId: 49 

Event[6696]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T13:27:22.3610000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 13 to 15.

Reason Unknown 

BootId: 49 

Event[6697]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-14T13:27:22.6930000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T09:27:15.569892500Z
Wake Time: ?2025?-?10?-?14T09:27:21.667299100Z

Wake Source: Power Button 

Event[6698]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T13:28:22.3880000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 15 to 16.

Reason SessionUnlock 

BootId: 49 

Event[6699]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T13:28:44.0380000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 16 to 18.

Reason InputHid 

BootId: 49 

Event[6700]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T14:24:58.6170000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 18 to 19.

Reason SessionUnlock 

BootId: 49 

Event[6701]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T14:25:29.3450000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 19 to 21.

Reason InputHid 

BootId: 49 

Event[6702]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-14T14:43:17.8910000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[6703]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T15:19:25.3490000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 21 to 22.

Reason SessionUnlock 

BootId: 49 

Event[6704]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T15:22:26.5880000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 22 to 24.

Reason InputHid 

BootId: 49 

Event[6705]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T15:27:26.6190000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 24 to 25.

Reason SessionUnlock 

BootId: 49 

Event[6706]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T15:32:49.4950000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 25 to 27.

Reason SxTransition 

BootId: 49 

Event[6707]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T15:32:52.2920000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[6708]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T15:32:54.0890000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[6709]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T15:32:57.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T11:32:57.500000000Z from ?2025?-?10?-?14T11:32:54.089599400Z.
Time Delta: 3410 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?14T15:32:57.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6710]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T15:32:57.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 3, FullResume: 684, AverageResume: 694 

Event[6711]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T15:32:57.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 29908043, SuspendEnd: 29908044 

Event[6712]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T15:32:57.6880000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 27 to 28.

Reason SxTransition 

BootId: 49 

Event[6713]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T15:32:58.4120000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 28 to 30.

Reason Unknown 

BootId: 49 

Event[6714]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-14T15:32:58.6990000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T11:32:49.482040600Z
Wake Time: ?2025?-?10?-?14T11:32:57.665658600Z

Wake Source: Power Button 

Event[6715]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T15:34:16.8320000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 30 to 31.

Reason SessionUnlock 

BootId: 49 

Event[6716]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T15:40:59.1840000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 31 to 33.

Reason InputHid 

BootId: 49 

Event[6717]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T15:42:51.7860000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\WinRAR.ShellExtension_d9ma7nkbkv4rp\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\47b86fda953346a8_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[6718]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T15:45:39.4520000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\SystemAppData\Helium\User.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[6719]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T15:45:39.4570000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat was cleared updating 2 keys and creating 1 modified pages. 

Event[6720]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T16:17:52.8960000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 33 to 34.

Reason SessionUnlock 

BootId: 49 

Event[6721]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T16:20:45.8220000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 34 to 36.

Reason InputHid 

BootId: 49 

Event[6722]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T16:33:02.8920000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 36 to 37.

Reason SessionUnlock 

BootId: 49 

Event[6723]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-14T16:35:00.3130000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[6724]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T16:37:02.5980000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 37 to 39.

Reason InputAccelerometer 

BootId: 49 

Event[6725]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-14T16:37:04.4930000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[6726]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T16:50:22.9950000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 39 to 40.

Reason SessionUnlock 

BootId: 49 

Event[6727]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T16:55:22.9160000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 40 to 42.

Reason SxTransition 

BootId: 49 

Event[6728]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T16:55:23.5730000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[6729]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T16:55:25.3690000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[6730]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T16:55:28.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T12:55:28.500000000Z from ?2025?-?10?-?14T12:55:25.369860500Z.
Time Delta: 3130 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?14T16:55:28.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6731]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T16:55:28.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 4, FullResume: 696, AverageResume: 694 

Event[6732]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T16:55:28.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 34853847, SuspendEnd: 34853848 

Event[6733]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T16:55:28.6760000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 42 to 43.

Reason SxTransition 

BootId: 49 

Event[6734]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T16:55:29.4210000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 43 to 45.

Reason Unknown 

BootId: 49 

Event[6735]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-14T16:55:29.7410000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T12:55:22.903373000Z
Wake Time: ?2025?-?10?-?14T12:55:28.670455300Z

Wake Source: Power Button 

Event[6736]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T16:56:30.4420000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 45 to 46.

Reason SessionUnlock 

BootId: 49 

Event[6737]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T17:05:56.0270000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 46 to 48.

Reason SxTransition 

BootId: 49 

Event[6738]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T17:05:56.4060000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[6739]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T17:05:58.0400000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[6740]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T17:06:01.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T13:06:01.500000000Z from ?2025?-?10?-?14T13:05:58.040235400Z.
Time Delta: 3459 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?14T17:06:01.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6741]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T17:06:01.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 5, FullResume: 697, AverageResume: 695 

Event[6742]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T17:06:01.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 35483138, SuspendEnd: 35483138 

Event[6743]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T17:06:01.6750000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 48 to 49.

Reason SxTransition 

BootId: 49 

Event[6744]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T17:06:02.4090000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 49 to 51.

Reason Unknown 

BootId: 49 

Event[6745]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-14T17:06:02.7050000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T13:05:56.015871500Z
Wake Time: ?2025?-?10?-?14T13:06:01.669794700Z

Wake Source: Power Button 

Event[6746]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-14T17:06:04.7860000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[6747]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T17:07:02.4310000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 51 to 52.

Reason SessionUnlock 

BootId: 49 

Event[6748]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-14T17:08:09.7150000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[6749]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-14T17:11:33.7220000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[6750]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-14T17:11:34.2660000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[6751]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-14T17:11:34.2660000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[6752]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-14T17:11:34.2660000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[6753]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-14T17:11:42.3190000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: 9PB0TRCNRHFX-Microsoft.AVCEncoderVideoExtension 

Event[6754]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T17:11:42.5600000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.AVCEncoderVideoExtension_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[6755]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-14T17:11:42.9910000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: 9PB0TRCNRHFX-Microsoft.AVCEncoderVideoExtension 

Event[6756]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-14T17:11:48.0540000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[6757]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T17:11:53.1450000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsTerminal_1.23.12811.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[6758]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-14T17:11:53.9820000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: 9N0DX20HK701-Microsoft.WindowsTerminal 

Event[6759]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T17:11:54.2080000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[6760]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-14T17:11:54.8020000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: 9N0DX20HK701-Microsoft.WindowsTerminal 

Event[6761]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-14T17:11:59.3970000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[6762]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T17:12:30.1940000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.CrossDevice_1.25092.33.0_x64__cw5n1h2txyewy\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[6763]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-14T17:12:31.2950000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: 9NTXGKQ8P7N0-MicrosoftWindows.CrossDevice 

Event[6764]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-14T17:12:32.2460000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: 9NTXGKQ8P7N0-MicrosoftWindows.CrossDevice 

Event[6765]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-14T17:12:37.3500000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[6766]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T17:12:51.3460000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.YourPhone_1.25092.34.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[6767]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-14T17:12:52.7490000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: 9NMPJ99VJBWV-Microsoft.YourPhone 

Event[6768]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-14T17:12:53.7630000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: 9NMPJ99VJBWV-Microsoft.YourPhone 

Event[6769]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T17:13:08.0070000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.ScreenSketch_11.2508.29.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[6770]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-14T17:13:09.1370000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: 9MZ95KL8MR0L-Microsoft.ScreenSketch 

Event[6771]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T17:13:09.3100000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsStore_22508.1401.9.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[6772]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-14T17:13:10.1810000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: 9MZ95KL8MR0L-Microsoft.ScreenSketch 

Event[6773]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-14T17:13:10.5900000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: 9WZDNCRFJBMP-MICROSOFT.WINDOWSSTORE 

Event[6774]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-14T17:13:11.6100000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: 9WZDNCRFJBMP-MICROSOFT.WINDOWSSTORE 

Event[6775]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T17:16:29.4730000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 52 to 54.

Reason SxTransition 

BootId: 49 

Event[6776]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T17:16:29.8490000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[6777]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T17:16:31.6480000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[6778]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T17:16:35.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T13:16:35.500000000Z from ?2025?-?10?-?14T13:16:31.648588300Z.
Time Delta: 3851 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?14T17:16:35.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6779]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T17:16:35.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 6, FullResume: 695, AverageResume: 695 

Event[6780]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T17:16:35.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 36113033, SuspendEnd: 36113034 

Event[6781]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T17:16:35.6830000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 54 to 55.

Reason SxTransition 

BootId: 49 

Event[6782]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T17:16:36.4110000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 55 to 57.

Reason Unknown 

BootId: 49 

Event[6783]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-14T17:16:36.7040000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T13:16:29.457856600Z
Wake Time: ?2025?-?10?-?14T13:16:35.668765800Z

Wake Source: Power Button 

Event[6784]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T17:17:36.4600000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 57 to 58.

Reason SessionUnlock 

BootId: 49 

Event[6785]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T17:18:25.0350000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 58 to 60.

Reason InputHid 

BootId: 49 

Event[6786]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T17:31:41.0070000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 60 to 61.

Reason SessionUnlock 

BootId: 49 

Event[6787]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T17:33:02.1790000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 61 to 63.

Reason InputHid 

BootId: 49 

Event[6788]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T17:55:57.5160000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 63 to 64.

Reason SessionUnlock 

BootId: 49 

Event[6789]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T17:56:47.9450000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 64 to 66.

Reason InputHid 

BootId: 49 

Event[6790]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T18:19:04.3540000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 66 to 67.

Reason SessionUnlock 

BootId: 49 

Event[6791]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T18:24:33.3420000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 67 to 69.

Reason SxTransition 

BootId: 49 

Event[6792]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T18:24:36.3050000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[6793]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T18:24:38.0060000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[6794]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T18:24:41.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T14:24:41.500000000Z from ?2025?-?10?-?14T14:24:38.006212200Z.
Time Delta: 3493 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?14T18:24:41.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6795]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T18:24:41.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 7, FullResume: 713, AverageResume: 697 

Event[6796]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T18:24:41.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 40193837, SuspendEnd: 40193837 

Event[6797]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T18:24:41.6740000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 69 to 70.

Reason SxTransition 

BootId: 49 

Event[6798]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T18:24:42.3750000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 70 to 72.

Reason Unknown 

BootId: 49 

Event[6799]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-14T18:24:42.7110000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T14:24:33.331120900Z
Wake Time: ?2025?-?10?-?14T14:24:41.669440600Z

Wake Source: Power Button 

Event[6800]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T18:26:33.4430000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 72 to 73.

Reason SessionUnlock 

BootId: 49 

Event[6801]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T18:34:52.4680000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 73 to 75.

Reason InputHid 

BootId: 49 

Event[6802]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T18:36:15.4750000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 75 to 76.

Reason SessionUnlock 

BootId: 49 

Event[6803]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T18:45:36.8180000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 76 to 78.

Reason SxTransition 

BootId: 49 

Event[6804]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T18:45:37.2080000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[6805]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T18:45:38.8610000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[6806]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T18:45:42.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T14:45:42.500000000Z from ?2025?-?10?-?14T14:45:38.861400600Z.
Time Delta: 3638 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?14T18:45:42.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6807]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T18:45:42.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 8, FullResume: 697, AverageResume: 697 

Event[6808]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T18:45:42.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 41450684, SuspendEnd: 41450684 

Event[6809]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T18:45:42.6750000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 78 to 79.

Reason SxTransition 

BootId: 49 

Event[6810]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T18:45:43.3920000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 79 to 81.

Reason Unknown 

BootId: 49 

Event[6811]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-14T18:45:43.7070000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T14:45:36.806983500Z
Wake Time: ?2025?-?10?-?14T14:45:42.668994400Z

Wake Source: Power Button 

Event[6812]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T18:47:00.4690000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 81 to 82.

Reason SessionUnlock 

BootId: 49 

Event[6813]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T18:47:29.6240000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 82 to 84.

Reason InputHid 

BootId: 49 

Event[6814]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T18:48:30.6400000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 84 to 85.

Reason SessionUnlock 

BootId: 49 

Event[6815]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T18:53:51.1600000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 85 to 87.

Reason InputHid 

BootId: 49 

Event[6816]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T18:54:51.2130000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 87 to 88.

Reason SessionUnlock 

BootId: 49 

Event[6817]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:04:10.4520000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 88 to 90.

Reason SxTransition 

BootId: 49 

Event[6818]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:04:10.8780000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[6819]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:04:12.0480000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[6820]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T19:04:15.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T15:04:15.500000000Z from ?2025?-?10?-?14T15:04:12.048153900Z.
Time Delta: 3451 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?14T19:04:15.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6821]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:04:15.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 9, FullResume: 689, AverageResume: 697 

Event[6822]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:04:15.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 42559780, SuspendEnd: 42559780 

Event[6823]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:04:15.6690000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 90 to 91.

Reason SxTransition 

BootId: 49 

Event[6824]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:04:16.3810000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 91 to 93.

Reason Unknown 

BootId: 49 

Event[6825]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-14T19:04:16.7000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T15:04:10.452184500Z
Wake Time: ?2025?-?10?-?14T15:04:15.675166200Z

Wake Source: Power Button 

Event[6826]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:05:16.4100000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 93 to 94.

Reason SessionUnlock 

BootId: 49 

Event[6827]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:06:27.3850000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 94 to 96.

Reason InputHid 

BootId: 49 

Event[6828]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:07:32.4350000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 96 to 97.

Reason SessionUnlock 

BootId: 49 

Event[6829]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:08:25.3780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 97 to 99.

Reason InputHid 

BootId: 49 

Event[6830]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:10:47.4480000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 99 to 100.

Reason SessionUnlock 

BootId: 49 

Event[6831]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:11:15.7300000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 100 to 102.

Reason InputHid 

BootId: 49 

Event[6832]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:12:15.7510000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 102 to 103.

Reason SessionUnlock 

BootId: 49 

Event[6833]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-14T19:19:14.3160000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[6834]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-14T19:19:14.3160000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[6835]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:21:43.9000000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 103 to 105.

Reason SxTransition 

BootId: 49 

Event[6836]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:21:44.2900000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[6837]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:21:45.4740000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[6838]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T19:21:49.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T15:21:49.500000000Z from ?2025?-?10?-?14T15:21:45.474656600Z.
Time Delta: 4025 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?14T19:21:49.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6839]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:21:49.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 10, FullResume: 684, AverageResume: 695 

Event[6840]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:21:49.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 43609327, SuspendEnd: 43609327 

Event[6841]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:21:49.6720000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 105 to 106.

Reason SxTransition 

BootId: 49 

Event[6842]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:21:50.4060000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 106 to 108.

Reason Unknown 

BootId: 49 

Event[6843]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-14T19:21:50.7140000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T15:21:43.889302500Z
Wake Time: ?2025?-?10?-?14T15:21:49.665902300Z

Wake Source: Power Button 

Event[6844]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:23:44.5000000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 108 to 109.

Reason SessionUnlock 

BootId: 49 

Event[6845]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:26:26.1800000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 109 to 111.

Reason InputHid 

BootId: 49 

Event[6846]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:42:11.5160000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 111 to 112.

Reason SessionUnlock 

BootId: 49 

Event[6847]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-14T19:42:33.8000000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[6848]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-14T19:42:33.8000000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.439.169.0) - Current Channel (Broad) 

Event[6849]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-14T19:42:44.8480000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.439.169.0) - Current Channel (Broad) 

Event[6850]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:44:30.0180000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 112 to 114.

Reason InputHid 

BootId: 49 

Event[6851]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:45:31.0580000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 114 to 115.

Reason SessionUnlock 

BootId: 49 

Event[6852]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:54:47.9630000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 115 to 117.

Reason SxTransition 

BootId: 49 

Event[6853]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:54:48.3490000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[6854]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:54:50.1140000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[6855]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T19:54:53.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T15:54:53.500000000Z from ?2025?-?10?-?14T15:54:50.114529200Z.
Time Delta: 3385 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?14T19:54:53.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6856]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:54:53.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 11, FullResume: 721, AverageResume: 698 

Event[6857]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:54:53.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 45589123, SuspendEnd: 45589124 

Event[6858]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:54:53.6790000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 117 to 118.

Reason SxTransition 

BootId: 49 

Event[6859]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:54:54.4650000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 118 to 120.

Reason Unknown 

BootId: 49 

Event[6860]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-14T19:54:54.6930000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T15:54:47.951304300Z
Wake Time: ?2025?-?10?-?14T15:54:53.670728200Z

Wake Source: Power Button 

Event[6861]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T19:55:54.4700000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 120 to 121.

Reason SessionUnlock 

BootId: 49 

Event[6862]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:05:21.3080000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 121 to 123.

Reason SxTransition 

BootId: 49 

Event[6863]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:05:21.6920000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[6864]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:05:23.3580000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[6865]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T20:05:26.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T16:05:26.500000000Z from ?2025?-?10?-?14T16:05:23.358815100Z.
Time Delta: 3141 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?14T20:05:26.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6866]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:05:26.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 12, FullResume: 718, AverageResume: 699 

Event[6867]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:05:26.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 46218731, SuspendEnd: 46218731 

Event[6868]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:05:26.6800000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 123 to 124.

Reason SxTransition 

BootId: 49 

Event[6869]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:05:27.3920000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 124 to 126.

Reason Unknown 

BootId: 49 

Event[6870]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-14T20:05:27.6920000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T16:05:21.295393200Z
Wake Time: ?2025?-?10?-?14T16:05:26.667989300Z

Wake Source: Power Button 

Event[6871]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:06:28.4320000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 126 to 127.

Reason SessionUnlock 

BootId: 49 

Event[6872]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:15:54.5060000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 127 to 129.

Reason SxTransition 

BootId: 49 

Event[6873]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:15:54.8890000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[6874]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:15:56.0430000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[6875]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T20:16:00.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T16:16:00.500000000Z from ?2025?-?10?-?14T16:15:56.043320300Z.
Time Delta: 4456 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?14T20:16:00.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6876]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:16:00.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 13, FullResume: 701, AverageResume: 699 

Event[6877]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:16:00.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 46848023, SuspendEnd: 46848024 

Event[6878]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:16:00.6760000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 129 to 130.

Reason SxTransition 

BootId: 49 

Event[6879]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:16:01.3750000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 130 to 132.

Reason Unknown 

BootId: 49 

Event[6880]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-14T20:16:01.6960000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T16:15:54.492086000Z
Wake Time: ?2025?-?10?-?14T16:16:00.669586700Z

Wake Source: Power Button 

Event[6881]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:17:01.4220000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 132 to 133.

Reason SessionUnlock 

BootId: 49 

Event[6882]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:26:28.9120000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 133 to 135.

Reason SxTransition 

BootId: 49 

Event[6883]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:26:29.2990000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[6884]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:26:30.4210000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[6885]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T20:26:33.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T16:26:33.500000000Z from ?2025?-?10?-?14T16:26:30.421526700Z.
Time Delta: 3078 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?14T20:26:33.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6886]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:26:33.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 14, FullResume: 697, AverageResume: 699 

Event[6887]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:26:33.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 47477693, SuspendEnd: 47477694 

Event[6888]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:26:33.6810000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 135 to 136.

Reason SxTransition 

BootId: 49 

Event[6889]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:26:34.4020000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 136 to 138.

Reason Unknown 

BootId: 49 

Event[6890]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-14T20:26:34.7070000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T16:26:28.896327300Z
Wake Time: ?2025?-?10?-?14T16:26:33.675504100Z

Wake Source: Power Button 

Event[6891]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:27:34.4350000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 138 to 139.

Reason SessionUnlock 

BootId: 49 

Event[6892]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:37:02.0210000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 139 to 141.

Reason SxTransition 

BootId: 49 

Event[6893]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:37:02.4000000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[6894]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:37:03.5540000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[6895]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T20:37:07.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T16:37:07.500000000Z from ?2025?-?10?-?14T16:37:03.554378100Z.
Time Delta: 3945 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?14T20:37:07.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6896]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:37:07.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 15, FullResume: 701, AverageResume: 699 

Event[6897]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:37:07.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 48107496, SuspendEnd: 48107497 

Event[6898]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:37:07.6780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 141 to 142.

Reason SxTransition 

BootId: 49 

Event[6899]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:37:08.3930000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 142 to 144.

Reason Unknown 

BootId: 49 

Event[6900]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-14T20:37:08.7010000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T16:37:02.003350700Z
Wake Time: ?2025?-?10?-?14T16:37:07.675081600Z

Wake Source: Power Button 

Event[6901]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:38:09.4570000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 144 to 145.

Reason SessionUnlock 

BootId: 49 

Event[6902]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:38:10.8990000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 145 to 147.

Reason InputHid 

BootId: 49 

Event[6903]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:40:05.9680000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 147 to 148.

Reason SessionUnlock 

BootId: 49 

Event[6904]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:48:48.6360000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 148 to 150.

Reason InputHid 

BootId: 49 

Event[6905]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:49:52.6780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 150 to 151.

Reason SessionUnlock 

BootId: 49 

Event[6906]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:59:05.9630000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 151 to 153.

Reason SxTransition 

BootId: 49 

Event[6907]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:59:06.3430000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[6908]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:59:07.5190000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[6909]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T20:59:11.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T16:59:11.500000000Z from ?2025?-?10?-?14T16:59:07.519179400Z.
Time Delta: 3980 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?14T20:59:11.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6910]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:59:11.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 16, FullResume: 699, AverageResume: 699 

Event[6911]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:59:11.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 49426974, SuspendEnd: 49426974 

Event[6912]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:59:11.6730000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 153 to 154.

Reason SxTransition 

BootId: 49 

Event[6913]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T20:59:12.4150000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 154 to 156.

Reason Unknown 

BootId: 49 

Event[6914]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-14T20:59:12.7150000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T16:59:05.951803600Z
Wake Time: ?2025?-?10?-?14T16:59:11.662800300Z

Wake Source: Power Button 

Event[6915]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:00:12.4480000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 156 to 157.

Reason SessionUnlock 

BootId: 49 

Event[6916]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:09:39.9200000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 157 to 159.

Reason SxTransition 

BootId: 49 

Event[6917]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:09:40.2800000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[6918]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:09:41.3820000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[6919]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T21:09:44.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T17:09:44.500000000Z from ?2025?-?10?-?14T17:09:41.382781100Z.
Time Delta: 3117 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?14T21:09:44.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6920]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:09:44.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 17, FullResume: 701, AverageResume: 699 

Event[6921]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:09:44.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 50056606, SuspendEnd: 50056606 

Event[6922]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:09:44.6740000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 159 to 160.

Reason SxTransition 

BootId: 49 

Event[6923]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:09:45.3870000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 160 to 162.

Reason Unknown 

BootId: 49 

Event[6924]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-14T21:09:45.7050000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T17:09:39.907916100Z
Wake Time: ?2025?-?10?-?14T17:09:44.673363800Z

Wake Source: Power Button 

Event[6925]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:11:21.2800000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 162 to 163.

Reason SessionUnlock 

BootId: 49 

Event[6926]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:20:43.0510000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 163 to 165.

Reason SxTransition 

BootId: 49 

Event[6927]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:20:43.4040000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[6928]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:20:45.0460000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[6929]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T21:20:48.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T17:20:48.500000000Z from ?2025?-?10?-?14T17:20:45.046812400Z.
Time Delta: 3453 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?14T21:20:48.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6930]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:20:48.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 18, FullResume: 707, AverageResume: 700 

Event[6931]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:20:48.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 50716889, SuspendEnd: 50716889 

Event[6932]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:20:48.6750000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 165 to 166.

Reason SxTransition 

BootId: 49 

Event[6933]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:20:49.3880000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 166 to 168.

Reason Unknown 

BootId: 49 

Event[6934]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-14T21:20:49.6930000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T17:20:43.039556500Z
Wake Time: ?2025?-?10?-?14T17:20:48.675082900Z

Wake Source: Power Button 

Event[6935]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:21:49.4230000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 168 to 169.

Reason SessionUnlock 

BootId: 49 

Event[6936]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:28:52.0000000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 169 to 171.

Reason InputHid 

BootId: 49 

Event[6937]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:30:22.0840000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 171 to 172.

Reason SessionUnlock 

BootId: 49 

Event[6938]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:39:46.5260000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 172 to 174.

Reason SxTransition 

BootId: 49 

Event[6939]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:39:46.9080000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[6940]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:39:48.5590000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[6941]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T21:39:52.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T17:39:52.500000000Z from ?2025?-?10?-?14T17:39:48.559407600Z.
Time Delta: 3940 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?14T21:39:52.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6942]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:39:52.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 19, FullResume: 681, AverageResume: 699 

Event[6943]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:39:52.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 51856483, SuspendEnd: 51856484 

Event[6944]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:39:52.6740000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 174 to 175.

Reason SxTransition 

BootId: 49 

Event[6945]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:39:53.3970000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 175 to 177.

Reason Unknown 

BootId: 49 

Event[6946]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-14T21:39:53.6950000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T17:39:46.512744500Z
Wake Time: ?2025?-?10?-?14T17:39:52.669702700Z

Wake Source: Power Button 

Event[6947]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:40:53.4430000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 177 to 178.

Reason SessionUnlock 

BootId: 49 

Event[6948]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:40:57.4020000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 178 to 180.

Reason InputHid 

BootId: 49 

Event[6949]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:42:03.4360000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 180 to 181.

Reason SessionUnlock 

BootId: 49 

Event[6950]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:51:20.4240000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 181 to 183.

Reason SxTransition 

BootId: 49 

Event[6951]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:51:20.8070000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[6952]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:51:22.4450000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[6953]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T21:51:25.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T17:51:25.500000000Z from ?2025?-?10?-?14T17:51:22.445189200Z.
Time Delta: 3054 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?14T21:51:25.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6954]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:51:25.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 20, FullResume: 693, AverageResume: 699 

Event[6955]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:51:25.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 52546152, SuspendEnd: 52546152 

Event[6956]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:51:25.6770000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 183 to 184.

Reason SxTransition 

BootId: 49 

Event[6957]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:51:26.4090000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 184 to 186.

Reason Unknown 

BootId: 49 

Event[6958]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-14T21:51:26.6950000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T17:51:20.406852000Z
Wake Time: ?2025?-?10?-?14T17:51:25.669936800Z

Wake Source: Power Button 

Event[6959]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T21:52:37.4840000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 186 to 187.

Reason SessionUnlock 

BootId: 49 

Event[6960]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:01:53.4970000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 187 to 189.

Reason SxTransition 

BootId: 49 

Event[6961]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:01:53.8750000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[6962]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:01:55.4950000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[6963]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T22:01:59.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T18:01:59.500000000Z from ?2025?-?10?-?14T18:01:55.495771300Z.
Time Delta: 4004 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?14T22:01:59.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6964]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:01:59.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 21, FullResume: 688, AverageResume: 698 

Event[6965]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:01:59.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 53175896, SuspendEnd: 53175897 

Event[6966]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:01:59.6700000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 189 to 190.

Reason SxTransition 

BootId: 49 

Event[6967]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:02:00.3920000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 190 to 192.

Reason Unknown 

BootId: 49 

Event[6968]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-14T22:02:00.7000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T18:01:53.484614100Z
Wake Time: ?2025?-?10?-?14T18:01:59.676971600Z

Wake Source: Power Button 

Event[6969]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:03:00.4000000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 192 to 193.

Reason SessionUnlock 

BootId: 49 

Event[6970]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:12:27.5180000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 193 to 195.

Reason SxTransition 

BootId: 49 

Event[6971]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:12:27.8970000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[6972]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:12:29.5330000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[6973]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T22:12:32.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T18:12:32.500000000Z from ?2025?-?10?-?14T18:12:29.533237200Z.
Time Delta: 2966 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?14T22:12:32.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6974]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:12:32.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 22, FullResume: 701, AverageResume: 698 

Event[6975]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:12:32.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 53805678, SuspendEnd: 53805678 

Event[6976]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:12:32.6800000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 195 to 196.

Reason SxTransition 

BootId: 49 

Event[6977]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:12:33.3910000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 196 to 198.

Reason Unknown 

BootId: 49 

Event[6978]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-14T22:12:33.7090000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T18:12:27.506940800Z
Wake Time: ?2025?-?10?-?14T18:12:32.669634800Z

Wake Source: Power Button 

Event[6979]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:13:51.4420000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 198 to 199.

Reason SessionUnlock 

BootId: 49 

Event[6980]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:23:00.4670000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 199 to 201.

Reason SxTransition 

BootId: 49 

Event[6981]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:23:00.8440000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[6982]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:23:02.5340000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[6983]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-14T22:23:06.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T18:23:06.500000000Z from ?2025?-?10?-?14T18:23:02.534735700Z.
Time Delta: 3965 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?14T22:23:06.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[6984]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:23:06.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 23, FullResume: 715, AverageResume: 699 

Event[6985]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:23:06.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 54435460, SuspendEnd: 54435461 

Event[6986]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:23:06.6750000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 201 to 202.

Reason SxTransition 

BootId: 49 

Event[6987]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:23:07.3840000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 202 to 204.

Reason Unknown 

BootId: 49 

Event[6988]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-14T22:23:07.6950000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T18:23:00.452779000Z
Wake Time: ?2025?-?10?-?14T18:23:06.672488800Z

Wake Source: Power Button 

Event[6989]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:24:07.4400000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 204 to 205.

Reason SessionUnlock 

BootId: 49 

Event[6990]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:26:43.9910000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 205 to 207.

Reason InputHid 

BootId: 49 

Event[6991]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:27:44.0080000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 207 to 208.

Reason SessionUnlock 

BootId: 49 

Event[6992]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:28:35.8700000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 208 to 210.

Reason InputHid 

BootId: 49 

Event[6993]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:29:36.8850000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 210 to 211.

Reason SessionUnlock 

BootId: 49 

Event[6994]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:34:10.7440000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 211 to 213.

Reason InputHid 

BootId: 49 

Event[6995]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:35:27.7490000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 213 to 214.

Reason SessionUnlock 

BootId: 49 

Event[6996]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:35:59.2290000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 214 to 216.

Reason InputHid 

BootId: 49 

Event[6997]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:37:00.2560000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 216 to 217.

Reason SessionUnlock 

BootId: 49 

Event[6998]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:41:02.4570000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 217 to 219.

Reason InputHid 

BootId: 49 

Event[6999]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:42:05.4970000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 219 to 220.

Reason SessionUnlock 

BootId: 49 

Event[7000]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:42:28.0970000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 220 to 222.

Reason InputHid 

BootId: 49 

Event[7001]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:44:25.1090000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 222 to 223.

Reason SessionUnlock 

BootId: 49 

Event[7002]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:44:33.3650000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 223 to 225.

Reason InputHid 

BootId: 49 

Event[7003]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:45:33.3870000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 225 to 226.

Reason SessionUnlock 

BootId: 49 

Event[7004]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:46:05.0380000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 226 to 228.

Reason InputHid 

BootId: 49 

Event[7005]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:47:55.1120000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 228 to 229.

Reason SessionUnlock 

BootId: 49 

Event[7006]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:53:13.5780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 229 to 231.

Reason InputHid 

BootId: 49 

Event[7007]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:54:13.5860000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 231 to 232.

Reason SessionUnlock 

BootId: 49 

Event[7008]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:54:25.8280000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 232 to 234.

Reason InputHid 

BootId: 49 

Event[7009]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:56:17.9210000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 234 to 235.

Reason SessionUnlock 

BootId: 49 

Event[7010]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:56:27.0550000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 235 to 237.

Reason InputHid 

BootId: 49 

Event[7011]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:57:36.0700000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 237 to 238.

Reason SessionUnlock 

BootId: 49 

Event[7012]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T22:58:05.6840000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 238 to 240.

Reason InputHid 

BootId: 49 

Event[7013]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T23:00:36.7270000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 240 to 241.

Reason SessionUnlock 

BootId: 49 

Event[7014]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T23:01:17.8860000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 241 to 243.

Reason InputHid 

BootId: 49 

Event[7015]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T23:06:49.8630000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 243 to 244.

Reason SessionUnlock 

BootId: 49 

Event[7016]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T23:06:58.5700000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 244 to 246.

Reason InputHid 

BootId: 49 

Event[7017]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T23:10:35.6390000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 246 to 247.

Reason SessionUnlock 

BootId: 49 

Event[7018]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T23:10:41.0280000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 247 to 249.

Reason InputHid 

BootId: 49 

Event[7019]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T23:14:17.7790000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 249 to 250.

Reason SessionUnlock 

BootId: 49 

Event[7020]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T23:14:28.7950000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 250 to 252.

Reason InputHid 

BootId: 49 

Event[7021]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T23:16:01.8210000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 252 to 253.

Reason SessionUnlock 

BootId: 49 

Event[7022]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T23:16:47.4550000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 253 to 255.

Reason InputHid 

BootId: 49 

Event[7023]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T23:20:46.2210000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 255 to 256.

Reason SessionUnlock 

BootId: 49 

Event[7024]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T23:20:49.3210000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 256 to 258.

Reason InputHid 

BootId: 49 

Event[7025]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T23:33:20.4860000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 258 to 259.

Reason SessionUnlock 

BootId: 49 

Event[7026]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T23:33:37.7800000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 259 to 261.

Reason InputHid 

BootId: 49 

Event[7027]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T23:43:43.0030000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 261 to 262.

Reason SessionUnlock 

BootId: 49 

Event[7028]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T23:43:48.9030000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 262 to 264.

Reason InputHid 

BootId: 49 

Event[7029]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-14T23:57:09.0530000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 264 to 265.

Reason SessionUnlock 

BootId: 49 

Event[7030]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:06:34.4570000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 265 to 267.

Reason SxTransition 

BootId: 49 

Event[7031]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:06:36.9340000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7032]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:06:38.6920000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7033]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T00:06:42.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T20:06:42.500000000Z from ?2025?-?10?-?14T20:06:38.692213200Z.
Time Delta: 3807 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T00:06:42.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7034]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:06:42.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 24, FullResume: 687, AverageResume: 698 

Event[7035]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:06:42.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 60645056, SuspendEnd: 60645057 

Event[7036]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:06:42.6710000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 267 to 268.

Reason SxTransition 

BootId: 49 

Event[7037]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:06:43.3990000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 268 to 270.

Reason Unknown 

BootId: 49 

Event[7038]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T00:06:43.7180000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T20:06:34.445231300Z
Wake Time: ?2025?-?10?-?14T20:06:42.669491000Z

Wake Source: Power Button 

Event[7039]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:07:43.4450000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 270 to 271.

Reason SessionUnlock 

BootId: 49 

Event[7040]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:17:08.2430000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 271 to 273.

Reason SxTransition 

BootId: 49 

Event[7041]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:17:08.6170000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7042]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:17:09.7800000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7043]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T00:17:13.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T20:17:13.500000000Z from ?2025?-?10?-?14T20:17:09.780913100Z.
Time Delta: 3719 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T00:17:13.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7044]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:17:13.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 25, FullResume: 700, AverageResume: 699 

Event[7045]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:17:13.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 61272087, SuspendEnd: 61272087 

Event[7046]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:17:13.6790000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 273 to 274.

Reason SxTransition 

BootId: 49 

Event[7047]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:17:14.4140000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 274 to 276.

Reason Unknown 

BootId: 49 

Event[7048]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T00:17:14.6940000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T20:17:08.230780200Z
Wake Time: ?2025?-?10?-?14T20:17:13.670806000Z

Wake Source: Power Button 

Event[7049]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:18:14.4500000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 276 to 277.

Reason SessionUnlock 

BootId: 49 

Event[7050]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:27:41.9770000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 277 to 279.

Reason SxTransition 

BootId: 49 

Event[7051]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:27:42.3620000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7052]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:27:44.0140000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7053]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T00:27:47.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T20:27:47.500000000Z from ?2025?-?10?-?14T20:27:44.014759200Z.
Time Delta: 3485 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T00:27:47.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7054]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:27:47.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 26, FullResume: 714, AverageResume: 699 

Event[7055]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:27:47.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 61902351, SuspendEnd: 61902351 

Event[7056]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:27:47.6810000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 279 to 280.

Reason SxTransition 

BootId: 49 

Event[7057]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:27:48.3910000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 280 to 282.

Reason Unknown 

BootId: 49 

Event[7058]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T00:27:48.6910000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T20:27:41.964710500Z
Wake Time: ?2025?-?10?-?14T20:27:47.667076300Z

Wake Source: Power Button 

Event[7059]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:28:48.4350000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 282 to 283.

Reason SessionUnlock 

BootId: 49 

Event[7060]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:38:15.4280000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 283 to 285.

Reason SxTransition 

BootId: 49 

Event[7061]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:38:15.8180000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7062]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:38:17.4380000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7063]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T00:38:20.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T20:38:20.500000000Z from ?2025?-?10?-?14T20:38:17.438128700Z.
Time Delta: 3061 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T00:38:20.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7064]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:38:20.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 27, FullResume: 699, AverageResume: 699 

Event[7065]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:38:20.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 62532037, SuspendEnd: 62532037 

Event[7066]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:38:20.6810000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 285 to 286.

Reason SxTransition 

BootId: 49 

Event[7067]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:38:21.3810000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 286 to 288.

Reason Unknown 

BootId: 49 

Event[7068]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T00:38:21.7030000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T20:38:15.426928800Z
Wake Time: ?2025?-?10?-?14T20:38:20.670614800Z

Wake Source: Power Button 

Event[7069]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:39:21.4290000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 288 to 289.

Reason SessionUnlock 

BootId: 49 

Event[7070]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:48:48.5070000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 289 to 291.

Reason SxTransition 

BootId: 49 

Event[7071]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:48:48.8150000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7072]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:48:49.9370000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7073]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T00:48:53.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T20:48:53.500000000Z from ?2025?-?10?-?14T20:48:49.937809900Z.
Time Delta: 3562 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T00:48:53.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7074]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:48:53.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 28, FullResume: 696, AverageResume: 699 

Event[7075]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:48:53.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 63161225, SuspendEnd: 63161225 

Event[7076]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:48:53.6700000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 291 to 292.

Reason SxTransition 

BootId: 49 

Event[7077]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:48:54.3750000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 292 to 294.

Reason Unknown 

BootId: 49 

Event[7078]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T00:48:54.7060000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T20:48:48.495128600Z
Wake Time: ?2025?-?10?-?14T20:48:53.670552100Z

Wake Source: Power Button 

Event[7079]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:49:54.4430000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 294 to 295.

Reason SessionUnlock 

BootId: 49 

Event[7080]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:59:22.0610000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 295 to 297.

Reason SxTransition 

BootId: 49 

Event[7081]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:59:22.4270000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7082]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:59:24.0390000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7083]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T00:59:27.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T20:59:27.500000000Z from ?2025?-?10?-?14T20:59:24.039616000Z.
Time Delta: 3460 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T00:59:27.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7084]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:59:27.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 29, FullResume: 711, AverageResume: 699 

Event[7085]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:59:27.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 63791514, SuspendEnd: 63791515 

Event[7086]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:59:27.6700000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 297 to 298.

Reason SxTransition 

BootId: 49 

Event[7087]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T00:59:28.4210000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 298 to 300.

Reason Unknown 

BootId: 49 

Event[7088]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T00:59:28.7010000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T20:59:22.049351800Z
Wake Time: ?2025?-?10?-?14T20:59:27.670413100Z

Wake Source: Power Button 

Event[7089]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:00:28.4610000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 300 to 301.

Reason SessionUnlock 

BootId: 49 

Event[7090]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:09:55.5380000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 301 to 303.

Reason SxTransition 

BootId: 49 

Event[7091]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:09:55.9130000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7092]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:09:57.5750000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7093]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T01:10:01.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T21:10:01.500000000Z from ?2025?-?10?-?14T21:09:57.575927800Z.
Time Delta: 3924 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T01:10:01.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7094]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:10:01.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 30, FullResume: 685, AverageResume: 699 

Event[7095]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:10:01.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 64421343, SuspendEnd: 64421343 

Event[7096]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:10:01.6730000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 303 to 304.

Reason SxTransition 

BootId: 49 

Event[7097]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:10:02.3930000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 304 to 306.

Reason Unknown 

BootId: 49 

Event[7098]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T01:10:02.7010000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T21:09:55.519070500Z
Wake Time: ?2025?-?10?-?14T21:10:01.673433400Z

Wake Source: Power Button 

Event[7099]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:11:02.4060000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 306 to 307.

Reason SessionUnlock 

BootId: 49 

Event[7100]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:20:29.4490000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 307 to 309.

Reason SxTransition 

BootId: 49 

Event[7101]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:20:29.8070000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7102]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:20:31.4090000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7103]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T01:20:34.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T21:20:34.500000000Z from ?2025?-?10?-?14T21:20:31.409793600Z.
Time Delta: 3090 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T01:20:34.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7104]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:20:34.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 31, FullResume: 702, AverageResume: 699 

Event[7105]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:20:34.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 65051000, SuspendEnd: 65051000 

Event[7106]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:20:34.6740000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 309 to 310.

Reason SxTransition 

BootId: 49 

Event[7107]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:20:35.3910000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 310 to 312.

Reason Unknown 

BootId: 49 

Event[7108]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T01:20:35.7240000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T21:20:29.438207000Z
Wake Time: ?2025?-?10?-?14T21:20:34.665962700Z

Wake Source: Power Button 

Event[7109]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:21:35.4080000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 312 to 313.

Reason SessionUnlock 

BootId: 49 

Event[7110]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:31:02.5410000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 313 to 315.

Reason SxTransition 

BootId: 49 

Event[7111]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:31:02.9010000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7112]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:31:04.0360000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7113]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T01:31:07.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T21:31:07.500000000Z from ?2025?-?10?-?14T21:31:04.036418500Z.
Time Delta: 3463 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T01:31:07.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7114]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:31:07.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 32, FullResume: 695, AverageResume: 699 

Event[7115]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:31:07.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 65680285, SuspendEnd: 65680285 

Event[7116]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:31:07.6760000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 315 to 316.

Reason SxTransition 

BootId: 49 

Event[7117]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:31:08.3790000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 316 to 318.

Reason Unknown 

BootId: 49 

Event[7118]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T01:31:08.6880000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T21:31:02.529675400Z
Wake Time: ?2025?-?10?-?14T21:31:07.667039600Z

Wake Source: Power Button 

Event[7119]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:32:08.4190000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 318 to 319.

Reason SessionUnlock 

BootId: 49 

Event[7120]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:41:35.9910000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 319 to 321.

Reason SxTransition 

BootId: 49 

Event[7121]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:41:36.3490000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7122]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:41:37.4960000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7123]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T01:41:41.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T21:41:41.500000000Z from ?2025?-?10?-?14T21:41:37.496623700Z.
Time Delta: 4003 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T01:41:41.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7124]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:41:41.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 33, FullResume: 719, AverageResume: 699 

Event[7125]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:41:41.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 66310030, SuspendEnd: 66310030 

Event[7126]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:41:41.6700000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 321 to 322.

Reason SxTransition 

BootId: 49 

Event[7127]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:41:42.3930000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 322 to 324.

Reason Unknown 

BootId: 49 

Event[7128]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T01:41:42.6920000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T21:41:35.979467700Z
Wake Time: ?2025?-?10?-?14T21:41:41.668566300Z

Wake Source: Power Button 

Event[7129]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:42:42.4320000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 324 to 325.

Reason SessionUnlock 

BootId: 49 

Event[7130]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:52:10.0110000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 325 to 327.

Reason SxTransition 

BootId: 49 

Event[7131]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:52:10.3620000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7132]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:52:11.4970000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7133]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T01:52:15.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T21:52:15.500000000Z from ?2025?-?10?-?14T21:52:11.497770600Z.
Time Delta: 4002 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T01:52:15.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7134]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:52:15.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 34, FullResume: 687, AverageResume: 699 

Event[7135]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:52:15.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 66939777, SuspendEnd: 66939778 

Event[7136]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:52:15.6820000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 327 to 328.

Reason SxTransition 

BootId: 49 

Event[7137]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:52:16.4410000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 328 to 330.

Reason Unknown 

BootId: 49 

Event[7138]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T01:52:16.7060000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T21:52:09.999187300Z
Wake Time: ?2025?-?10?-?14T21:52:15.675974900Z

Wake Source: Power Button 

Event[7139]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T01:53:16.4800000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 330 to 331.

Reason SessionUnlock 

BootId: 49 

Event[7140]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:02:44.0060000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 331 to 333.

Reason SxTransition 

BootId: 49 

Event[7141]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:02:44.4030000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7142]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:02:46.0500000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7143]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T02:02:49.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T22:02:49.500000000Z from ?2025?-?10?-?14T22:02:46.050301600Z.
Time Delta: 3449 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T02:02:49.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7144]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:02:49.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 35, FullResume: 695, AverageResume: 699 

Event[7145]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:02:49.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 67570078, SuspendEnd: 67570078 

Event[7146]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:02:49.6720000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 333 to 334.

Reason SxTransition 

BootId: 49 

Event[7147]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:02:50.3920000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 334 to 336.

Reason Unknown 

BootId: 49 

Event[7148]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T02:02:50.6980000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T22:02:43.995127500Z
Wake Time: ?2025?-?10?-?14T22:02:49.670399600Z

Wake Source: Power Button 

Event[7149]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:03:50.4230000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 336 to 337.

Reason SessionUnlock 

BootId: 49 

Event[7150]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:13:17.4500000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 337 to 339.

Reason SxTransition 

BootId: 49 

Event[7151]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:13:17.8070000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7152]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:13:18.8970000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7153]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T02:13:22.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T22:13:22.500000000Z from ?2025?-?10?-?14T22:13:18.897403400Z.
Time Delta: 3602 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T02:13:22.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7154]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:13:22.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 36, FullResume: 702, AverageResume: 699 

Event[7155]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:13:22.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 68199224, SuspendEnd: 68199224 

Event[7156]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:13:22.6800000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 339 to 340.

Reason SxTransition 

BootId: 49 

Event[7157]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:13:23.3970000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 340 to 342.

Reason Unknown 

BootId: 49 

Event[7158]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T02:13:23.7310000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T22:13:17.449440500Z
Wake Time: ?2025?-?10?-?14T22:13:22.668072100Z

Wake Source: Power Button 

Event[7159]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:14:23.4160000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 342 to 343.

Reason SessionUnlock 

BootId: 49 

Event[7160]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:23:51.0540000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 343 to 345.

Reason SxTransition 

BootId: 49 

Event[7161]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:23:51.4160000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7162]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:23:53.0710000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7163]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T02:23:56.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T22:23:56.500000000Z from ?2025?-?10?-?14T22:23:53.071321000Z.
Time Delta: 3428 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T02:23:56.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7164]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:23:56.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 37, FullResume: 702, AverageResume: 699 

Event[7165]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:23:56.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 68829544, SuspendEnd: 68829544 

Event[7166]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:23:56.6780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 345 to 346.

Reason SxTransition 

BootId: 49 

Event[7167]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:23:57.3920000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 346 to 348.

Reason Unknown 

BootId: 49 

Event[7168]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T02:23:57.7070000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T22:23:51.042795200Z
Wake Time: ?2025?-?10?-?14T22:23:56.669992400Z

Wake Source: Power Button 

Event[7169]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:24:57.4150000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 348 to 349.

Reason SessionUnlock 

BootId: 49 

Event[7170]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:34:24.4980000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 349 to 351.

Reason SxTransition 

BootId: 49 

Event[7171]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:34:24.8480000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7172]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:34:25.9650000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7173]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T02:34:29.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T22:34:29.500000000Z from ?2025?-?10?-?14T22:34:25.965189000Z.
Time Delta: 3534 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T02:34:29.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7174]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:34:29.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 38, FullResume: 696, AverageResume: 699 

Event[7175]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:34:29.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 69458759, SuspendEnd: 69458759 

Event[7176]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:34:29.6740000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 351 to 352.

Reason SxTransition 

BootId: 49 

Event[7177]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:34:30.3920000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 352 to 354.

Reason Unknown 

BootId: 49 

Event[7178]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T02:34:30.7070000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T22:34:24.485373200Z
Wake Time: ?2025?-?10?-?14T22:34:29.672686800Z

Wake Source: Power Button 

Event[7179]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:35:30.4080000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 354 to 355.

Reason SessionUnlock 

BootId: 49 

Event[7180]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:44:58.0220000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 355 to 357.

Reason SxTransition 

BootId: 49 

Event[7181]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:44:58.3410000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7182]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:44:59.9870000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7183]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T02:45:03.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T22:45:03.500000000Z from ?2025?-?10?-?14T22:44:59.987890700Z.
Time Delta: 3512 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T02:45:03.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7184]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:45:03.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 39, FullResume: 690, AverageResume: 699 

Event[7185]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:45:03.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 70088993, SuspendEnd: 70088993 

Event[7186]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:45:03.6760000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 357 to 358.

Reason SxTransition 

BootId: 49 

Event[7187]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:45:04.4040000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 358 to 360.

Reason Unknown 

BootId: 49 

Event[7188]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T02:45:04.6980000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T22:44:58.010155600Z
Wake Time: ?2025?-?10?-?14T22:45:03.678361800Z

Wake Source: Power Button 

Event[7189]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:46:04.4590000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 360 to 361.

Reason SessionUnlock 

BootId: 49 

Event[7190]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:55:31.5490000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 361 to 363.

Reason SxTransition 

BootId: 49 

Event[7191]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:55:31.8700000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7192]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:55:33.0070000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7193]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T02:55:36.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T22:55:36.500000000Z from ?2025?-?10?-?14T22:55:33.006957600Z.
Time Delta: 3493 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T02:55:36.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7194]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:55:36.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 40, FullResume: 692, AverageResume: 699 

Event[7195]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:55:36.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 70718250, SuspendEnd: 70718251 

Event[7196]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:55:36.6840000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 363 to 364.

Reason SxTransition 

BootId: 49 

Event[7197]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:55:37.4060000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 364 to 366.

Reason Unknown 

BootId: 49 

Event[7198]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T02:55:37.6980000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T22:55:31.537081100Z
Wake Time: ?2025?-?10?-?14T22:55:36.666279700Z

Wake Source: Power Button 

Event[7199]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T02:56:37.4110000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 366 to 367.

Reason SessionUnlock 

BootId: 49 

Event[7200]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:06:05.0170000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 367 to 369.

Reason SxTransition 

BootId: 49 

Event[7201]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:06:05.3520000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7202]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:06:06.9840000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7203]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T03:06:10.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T23:06:10.500000000Z from ?2025?-?10?-?14T23:06:06.984243200Z.
Time Delta: 3515 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T03:06:10.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7204]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:06:10.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 41, FullResume: 695, AverageResume: 699 

Event[7205]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:06:10.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 71348480, SuspendEnd: 71348480 

Event[7206]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:06:10.6740000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 369 to 370.

Reason SxTransition 

BootId: 49 

Event[7207]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:06:11.3800000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 370 to 372.

Reason Unknown 

BootId: 49 

Event[7208]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T03:06:11.7120000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T23:06:05.004804700Z
Wake Time: ?2025?-?10?-?14T23:06:10.678234800Z

Wake Source: Power Button 

Event[7209]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:07:11.4320000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 372 to 373.

Reason SessionUnlock 

BootId: 49 

Event[7210]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:16:38.5450000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 373 to 375.

Reason SxTransition 

BootId: 49 

Event[7211]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:16:38.8850000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7212]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:16:40.5130000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7213]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T03:16:44.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T23:16:44.500000000Z from ?2025?-?10?-?14T23:16:40.512974900Z.
Time Delta: 3987 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T03:16:44.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7214]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:16:44.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 42, FullResume: 785, AverageResume: 701 

Event[7215]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:16:44.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 71978244, SuspendEnd: 71978245 

Event[7216]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:16:44.6820000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 375 to 376.

Reason SxTransition 

BootId: 49 

Event[7217]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:16:45.4390000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 376 to 378.

Reason Unknown 

BootId: 49 

Event[7218]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T03:16:45.6980000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T23:16:38.531621600Z
Wake Time: ?2025?-?10?-?14T23:16:44.673894800Z

Wake Source: Power Button 

Event[7219]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:17:45.4660000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 378 to 379.

Reason SessionUnlock 

BootId: 49 

Event[7220]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:27:13.0350000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 379 to 381.

Reason SxTransition 

BootId: 49 

Event[7221]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:27:13.3900000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7222]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:27:15.0180000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7223]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T03:27:18.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T23:27:18.500000000Z from ?2025?-?10?-?14T23:27:15.018006200Z.
Time Delta: 3481 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T03:27:18.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7224]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:27:18.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 43, FullResume: 715, AverageResume: 701 

Event[7225]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:27:18.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 72608509, SuspendEnd: 72608510 

Event[7226]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-15T03:27:18.6520000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[7227]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:27:18.6820000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 381 to 382.

Reason SxTransition 

BootId: 49 

Event[7228]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T03:27:19.1270000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T23:27:13.015907700Z
Wake Time: ?2025?-?10?-?14T23:27:18.669708100Z

Wake Source: Power Button 

Event[7229]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:27:19.4070000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 382 to 384.

Reason Unknown 

BootId: 49 

Event[7230]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-15T03:27:21.4350000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->40.81.94.65:123). 

Event[7231]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-15T03:27:36.3820000Z
  Event ID: 35
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time service is now synchronizing the system time with the time source time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->40.81.94.65:123) with reference id 1096700200. Current local stratum number is 4. 

Event[7232]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T03:27:36.3830000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -240. 

Event[7233]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T03:27:36.3830000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T23:27:36.383571200Z from ?2025?-?10?-?14T23:27:36.382284300Z.
Time Delta: 1 ms

Change Reason: An application or system component changed the time.
Process: '\Device\HarddiskVolume3\Windows\System32\svchost.exe' (PID 6012).

RTC time: ?2025?-?10?-?15T03:27:36.383571200Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7234]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:28:19.4380000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 384 to 385.

Reason SessionUnlock 

BootId: 49 

Event[7235]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:37:46.0080000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 385 to 387.

Reason SxTransition 

BootId: 49 

Event[7236]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:37:46.3600000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7237]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:37:48.0170000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7238]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T03:37:51.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T23:37:51.500000000Z from ?2025?-?10?-?14T23:37:48.017262400Z.
Time Delta: 3482 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T03:37:51.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7239]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:37:51.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 44, FullResume: 721, AverageResume: 701 

Event[7240]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:37:51.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 73237776, SuspendEnd: 73237776 

Event[7241]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:37:51.6740000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 387 to 388.

Reason SxTransition 

BootId: 49 

Event[7242]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:37:52.4220000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 388 to 390.

Reason Unknown 

BootId: 49 

Event[7243]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T03:37:52.7020000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T23:37:45.992588900Z
Wake Time: ?2025?-?10?-?14T23:37:51.673211200Z

Wake Source: Power Button 

Event[7244]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:38:52.4560000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 390 to 391.

Reason SessionUnlock 

BootId: 49 

Event[7245]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:48:19.4930000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 391 to 393.

Reason SxTransition 

BootId: 49 

Event[7246]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:48:19.8510000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7247]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:48:20.9710000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7248]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T03:48:24.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T23:48:24.500000000Z from ?2025?-?10?-?14T23:48:20.971719400Z.
Time Delta: 3528 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T03:48:24.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7249]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:48:24.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 45, FullResume: 716, AverageResume: 702 

Event[7250]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:48:24.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 73866995, SuspendEnd: 73866995 

Event[7251]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:48:24.6780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 393 to 394.

Reason SxTransition 

BootId: 49 

Event[7252]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:48:25.4140000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 394 to 396.

Reason Unknown 

BootId: 49 

Event[7253]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T03:48:25.7100000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T23:48:19.492882200Z
Wake Time: ?2025?-?10?-?14T23:48:24.668531700Z

Wake Source: Power Button 

Event[7254]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:49:25.4320000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 396 to 397.

Reason SessionUnlock 

BootId: 49 

Event[7255]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:58:53.0290000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 397 to 399.

Reason SxTransition 

BootId: 49 

Event[7256]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:58:53.3660000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7257]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:58:54.4870000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7258]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T03:58:58.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?14T23:58:58.500000000Z from ?2025?-?10?-?14T23:58:54.487599800Z.
Time Delta: 4012 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T03:58:58.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7259]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:58:58.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 46, FullResume: 686, AverageResume: 701 

Event[7260]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:58:58.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 74496733, SuspendEnd: 74496734 

Event[7261]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:58:58.6840000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 399 to 400.

Reason SxTransition 

BootId: 49 

Event[7262]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:58:59.4020000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 400 to 402.

Reason Unknown 

BootId: 49 

Event[7263]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T03:58:59.7010000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?14T23:58:53.013748800Z
Wake Time: ?2025?-?10?-?14T23:58:58.679126000Z

Wake Source: Power Button 

Event[7264]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T03:59:59.4930000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 402 to 403.

Reason SessionUnlock 

BootId: 49 

Event[7265]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:09:27.0260000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 403 to 405.

Reason SxTransition 

BootId: 49 

Event[7266]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:09:27.3870000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7267]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:09:29.0170000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7268]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T04:09:32.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T00:09:32.500000000Z from ?2025?-?10?-?15T00:09:29.017186600Z.
Time Delta: 3482 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T04:09:32.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7269]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:09:32.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 47, FullResume: 689, AverageResume: 701 

Event[7270]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:09:32.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 75126999, SuspendEnd: 75126999 

Event[7271]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:09:32.6790000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 405 to 406.

Reason SxTransition 

BootId: 49 

Event[7272]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:09:33.4100000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 406 to 408.

Reason Unknown 

BootId: 49 

Event[7273]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T04:09:33.6910000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T00:09:27.009262500Z
Wake Time: ?2025?-?10?-?15T00:09:32.665880500Z

Wake Source: Power Button 

Event[7274]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:10:33.4440000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 408 to 409.

Reason SessionUnlock 

BootId: 49 

Event[7275]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:20:00.5240000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 409 to 411.

Reason SxTransition 

BootId: 49 

Event[7276]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:20:00.8220000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7277]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:20:02.4620000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7278]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T04:20:05.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T00:20:05.500000000Z from ?2025?-?10?-?15T00:20:02.462509500Z.
Time Delta: 3037 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T04:20:05.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7279]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:20:05.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 48, FullResume: 700, AverageResume: 701 

Event[7280]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:20:05.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 75756709, SuspendEnd: 75756710 

Event[7281]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:20:05.6800000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 411 to 412.

Reason SxTransition 

BootId: 49 

Event[7282]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:20:06.4170000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 412 to 414.

Reason Unknown 

BootId: 49 

Event[7283]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T04:20:06.7180000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T00:20:00.510094700Z
Wake Time: ?2025?-?10?-?15T00:20:05.669091300Z

Wake Source: Power Button 

Event[7284]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:21:06.4530000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 414 to 415.

Reason SessionUnlock 

BootId: 49 

Event[7285]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:30:33.5580000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 415 to 417.

Reason SxTransition 

BootId: 49 

Event[7286]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:30:33.9170000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7287]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:30:35.0560000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7288]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T04:30:38.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T00:30:38.500000000Z from ?2025?-?10?-?15T00:30:35.056809600Z.
Time Delta: 3443 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T04:30:38.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7289]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:30:38.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 49, FullResume: 693, AverageResume: 701 

Event[7290]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:30:38.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 76386013, SuspendEnd: 76386014 

Event[7291]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:30:38.6750000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 417 to 418.

Reason SxTransition 

BootId: 49 

Event[7292]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:30:39.3900000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 418 to 420.

Reason Unknown 

BootId: 49 

Event[7293]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T04:30:39.6990000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T00:30:33.540073700Z
Wake Time: ?2025?-?10?-?15T00:30:38.666512700Z

Wake Source: Power Button 

Event[7294]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:31:39.4250000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 420 to 421.

Reason SessionUnlock 

BootId: 49 

Event[7295]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:41:06.9850000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 421 to 423.

Reason SxTransition 

BootId: 49 

Event[7296]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:41:07.3320000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7297]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:41:08.4890000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7298]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T04:41:12.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T00:41:12.500000000Z from ?2025?-?10?-?15T00:41:08.489777700Z.
Time Delta: 4010 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T04:41:12.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7299]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:41:12.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 50, FullResume: 721, AverageResume: 701 

Event[7300]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:41:12.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 77015752, SuspendEnd: 77015752 

Event[7301]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:41:12.6760000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 423 to 424.

Reason SxTransition 

BootId: 49 

Event[7302]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:41:13.4310000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 424 to 426.

Reason Unknown 

BootId: 49 

Event[7303]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T04:41:13.7260000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T00:41:06.971218300Z
Wake Time: ?2025?-?10?-?15T00:41:12.669283800Z

Wake Source: Power Button 

Event[7304]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:42:13.4720000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 426 to 427.

Reason SessionUnlock 

BootId: 49 

Event[7305]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:51:41.0140000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 427 to 429.

Reason SxTransition 

BootId: 49 

Event[7306]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:51:41.3670000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7307]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:51:42.4930000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7308]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T04:51:45.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T00:51:45.500000000Z from ?2025?-?10?-?15T00:51:42.493073100Z.
Time Delta: 3006 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T04:51:45.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7309]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:51:45.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 51, FullResume: 681, AverageResume: 701 

Event[7310]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:51:45.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 77645492, SuspendEnd: 77645493 

Event[7311]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:51:45.6770000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 429 to 430.

Reason SxTransition 

BootId: 49 

Event[7312]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:51:46.4240000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 430 to 432.

Reason Unknown 

BootId: 49 

Event[7313]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T04:51:46.6880000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T00:51:40.999005300Z
Wake Time: ?2025?-?10?-?15T00:51:45.670046200Z

Wake Source: Power Button 

Event[7314]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T04:52:46.4530000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 432 to 433.

Reason SessionUnlock 

BootId: 49 

Event[7315]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:02:14.0190000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 433 to 435.

Reason SxTransition 

BootId: 49 

Event[7316]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:02:14.3750000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7317]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:02:16.0240000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7318]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T05:02:19.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T01:02:19.500000000Z from ?2025?-?10?-?15T01:02:16.024077100Z.
Time Delta: 3475 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T05:02:19.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7319]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:02:19.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 52, FullResume: 691, AverageResume: 701 

Event[7320]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:02:19.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 78275766, SuspendEnd: 78275767 

Event[7321]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:02:19.6780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 435 to 436.

Reason SxTransition 

BootId: 49 

Event[7322]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:02:20.3920000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 436 to 438.

Reason Unknown 

BootId: 49 

Event[7323]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T05:02:20.7310000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T01:02:14.001567300Z
Wake Time: ?2025?-?10?-?15T01:02:19.672238800Z

Wake Source: Power Button 

Event[7324]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:03:20.4150000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 438 to 439.

Reason SessionUnlock 

BootId: 49 

Event[7325]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:12:47.4890000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 439 to 441.

Reason SxTransition 

BootId: 49 

Event[7326]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:12:47.8040000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7327]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:12:48.9170000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7328]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T05:12:53.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T01:12:53.500000000Z from ?2025?-?10?-?15T01:12:48.917246200Z.
Time Delta: 4582 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T05:12:53.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7329]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:12:53.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 53, FullResume: 694, AverageResume: 701 

Event[7330]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:12:53.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 78904933, SuspendEnd: 78904933 

Event[7331]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:12:53.6760000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 441 to 442.

Reason SxTransition 

BootId: 49 

Event[7332]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:12:54.3840000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 442 to 444.

Reason Unknown 

BootId: 49 

Event[7333]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T05:12:54.7340000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T01:12:47.474286800Z
Wake Time: ?2025?-?10?-?15T01:12:53.670417500Z

Wake Source: Power Button 

Event[7334]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:13:55.4370000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 444 to 445.

Reason SessionUnlock 

BootId: 49 

Event[7335]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:23:22.0900000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 445 to 447.

Reason SxTransition 

BootId: 49 

Event[7336]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:23:22.4120000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7337]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:23:23.5490000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7338]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T05:23:26.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T01:23:26.500000000Z from ?2025?-?10?-?15T01:23:23.549771800Z.
Time Delta: 2950 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T05:23:26.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7339]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:23:26.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 54, FullResume: 697, AverageResume: 701 

Event[7340]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:23:26.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 79534732, SuspendEnd: 79534733 

Event[7341]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:23:26.6670000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 447 to 448.

Reason SxTransition 

BootId: 49 

Event[7342]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:23:27.3960000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 448 to 450.

Reason Unknown 

BootId: 49 

Event[7343]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T05:23:27.7080000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T01:23:22.076314000Z
Wake Time: ?2025?-?10?-?15T01:23:26.673845200Z

Wake Source: Power Button 

Event[7344]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:24:28.3950000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 450 to 451.

Reason SessionUnlock 

BootId: 49 

Event[7345]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:29:20.1830000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 451 to 453.

Reason InputHid 

BootId: 49 

Event[7346]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:30:21.1830000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 453 to 454.

Reason SessionUnlock 

BootId: 49 

Event[7347]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T05:35:54.0110000Z
  Event ID: 11
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy5\WINDOWS\System32\config\SYSTEM (TM: {d930dd6c-a8ab-11f0-a0d3-507b9da345ea}, RM: {d930dd6b-a8ab-11f0-a0d3-507b9da345ea}) finished with result=0xC00000A2 (Internal code=7). 

Event[7348]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T05:35:54.0880000Z
  Event ID: 11
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy5\WINDOWS\System32\config\DRIVERS (TM: {d930dd6f-a8ab-11f0-a0d3-507b9da345ea}, RM: {d930dd6e-a8ab-11f0-a0d3-507b9da345ea}) finished with result=0xC00000A2 (Internal code=7). 

Event[7349]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T05:35:55.1530000Z
  Event ID: 11
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
TxR init phase for hive \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy5\WINDOWS\System32\config\SOFTWARE (TM: {d930dd72-a8ab-11f0-a0d3-507b9da345ea}, RM: {d930dd71-a8ab-11f0-a0d3-507b9da345ea}) finished with result=0xC00000A2 (Internal code=7). 

Event[7350]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T05:36:09.4050000Z
  Event ID: 15
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Hive \??\Volume{1a7b3828-61d4-4cd2-b69a-63a772d651bf}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{E3CFED18-FE9F-4573-9EE1-5F3B62688A15} was reorganized with a starting size of 43216896 bytes and an ending size of 43139072 bytes. 

Event[7351]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T05:36:09.7120000Z
  Event ID: 15
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Hive \??\Volume{1a7b3828-61d4-4cd2-b69a-63a772d651bf}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{9C45AE83-8176-47FE-8CFD-E8C72F952F91} was reorganized with a starting size of 10756096 bytes and an ending size of 10739712 bytes. 

Event[7352]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:39:25.0170000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 454 to 456.

Reason SxTransition 

BootId: 49 

Event[7353]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:39:25.3420000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7354]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:39:27.0660000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7355]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T05:39:30.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T01:39:30.500000000Z from ?2025?-?10?-?15T01:39:27.066686600Z.
Time Delta: 3433 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T05:39:30.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7356]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:39:30.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 55, FullResume: 712, AverageResume: 701 

Event[7357]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:39:30.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 80494910, SuspendEnd: 80494910 

Event[7358]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:39:30.6750000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 456 to 457.

Reason SxTransition 

BootId: 49 

Event[7359]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:39:31.4000000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 457 to 459.

Reason Unknown 

BootId: 49 

Event[7360]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T05:39:31.6990000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T01:39:25.004831000Z
Wake Time: ?2025?-?10?-?15T01:39:30.667516500Z

Wake Source: Power Button 

Event[7361]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:40:31.4420000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 459 to 460.

Reason SessionUnlock 

BootId: 49 

Event[7362]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:42:06.9490000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 460 to 462.

Reason InputHid 

BootId: 49 

Event[7363]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:43:06.9620000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 462 to 463.

Reason SessionUnlock 

BootId: 49 

Event[7364]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:43:44.6630000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 463 to 465.

Reason InputHid 

BootId: 49 

Event[7365]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:44:44.6760000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 465 to 466.

Reason SessionUnlock 

BootId: 49 

Event[7366]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:53:58.4480000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 466 to 468.

Reason SxTransition 

BootId: 49 

Event[7367]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:53:58.8300000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[7368]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:54:00.4590000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7369]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T05:54:04.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T01:54:04.500000000Z from ?2025?-?10?-?15T01:54:00.459095900Z.
Time Delta: 4040 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T05:54:04.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7370]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:54:04.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 56, FullResume: 685, AverageResume: 701 

Event[7371]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:54:04.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 81364517, SuspendEnd: 81364517 

Event[7372]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:54:04.6720000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 468 to 469.

Reason SxTransition 

BootId: 49 

Event[7373]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:54:05.3830000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 469 to 471.

Reason Unknown 

BootId: 49 

Event[7374]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T05:54:05.7360000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T01:53:58.437048600Z
Wake Time: ?2025?-?10?-?15T01:54:04.672754600Z

Wake Source: Power Button 

Event[7375]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:55:32.4090000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 471 to 472.

Reason SessionUnlock 

BootId: 49 

Event[7376]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:57:05.7830000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 472 to 474.

Reason InputHid 

BootId: 49 

Event[7377]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T05:58:06.8070000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 474 to 475.

Reason SessionUnlock 

BootId: 49 

Event[7378]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:04:18.6270000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 475 to 477.

Reason InputHid 

BootId: 49 

Event[7379]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:05:19.6650000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 477 to 478.

Reason SessionUnlock 

BootId: 49 

Event[7380]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:06:11.3300000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 478 to 480.

Reason InputHid 

BootId: 49 

Event[7381]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:07:12.3520000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 480 to 481.

Reason SessionUnlock 

BootId: 49 

Event[7382]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:08:25.2880000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 481 to 483.

Reason InputHid 

BootId: 49 

Event[7383]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:10:17.3040000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 483 to 484.

Reason SessionUnlock 

BootId: 49 

Event[7384]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:10:47.2120000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 484 to 486.

Reason InputHid 

BootId: 49 

Event[7385]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:11:48.2710000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 486 to 487.

Reason SessionUnlock 

BootId: 49 

Event[7386]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:14:15.6450000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 487 to 489.

Reason InputHid 

BootId: 49 

Event[7387]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:15:17.6660000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 489 to 490.

Reason SessionUnlock 

BootId: 49 

Event[7388]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:18:57.2720000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 490 to 492.

Reason InputHid 

BootId: 49 

Event[7389]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:19:59.3040000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 492 to 493.

Reason SessionUnlock 

BootId: 49 

Event[7390]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:22:42.4480000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 493 to 495.

Reason InputHid 

BootId: 49 

Event[7391]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:23:43.4530000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 495 to 496.

Reason SessionUnlock 

BootId: 49 

Event[7392]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:23:57.9460000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 496 to 498.

Reason InputHid 

BootId: 49 

Event[7393]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:24:58.9620000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 498 to 499.

Reason SessionUnlock 

BootId: 49 

Event[7394]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-15T06:30:36.0740000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name signaler-pa.clients6.google.com timed out after none of the configured DNS servers responded. Client PID 3732. 

Event[7395]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:32:34.2710000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 499 to 501.

Reason InputHid 

BootId: 49 

Event[7396]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:34:13.2880000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 501 to 502.

Reason SessionUnlock 

BootId: 49 

Event[7397]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:41:01.5200000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 502 to 504.

Reason InputHid 

BootId: 49 

Event[7398]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:42:02.5460000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 504 to 505.

Reason SessionUnlock 

BootId: 49 

Event[7399]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:44:21.4560000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 505 to 507.

Reason InputHid 

BootId: 49 

Event[7400]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:45:21.4890000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 507 to 508.

Reason SessionUnlock 

BootId: 49 

Event[7401]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:47:00.1810000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 508 to 510.

Reason InputHid 

BootId: 49 

Event[7402]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:48:01.2030000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 510 to 511.

Reason SessionUnlock 

BootId: 49 

Event[7403]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:48:21.8890000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 511 to 513.

Reason InputHid 

BootId: 49 

Event[7404]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:49:59.8890000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 513 to 514.

Reason SessionUnlock 

BootId: 49 

Event[7405]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:54:23.0930000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 514 to 516.

Reason InputHid 

BootId: 49 

Event[7406]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T06:55:24.1180000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 516 to 517.

Reason SessionUnlock 

BootId: 49 

Event[7407]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T07:03:12.9160000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 517 to 519.

Reason InputHid 

BootId: 49 

Event[7408]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T07:04:13.9390000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 519 to 520.

Reason SessionUnlock 

BootId: 49 

Event[7409]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T07:05:29.7650000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 520 to 522.

Reason InputHid 

BootId: 49 

Event[7410]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T07:06:30.7890000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 522 to 523.

Reason SessionUnlock 

BootId: 49 

Event[7411]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T07:12:52.7320000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 523 to 525.

Reason InputHid 

BootId: 49 

Event[7412]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T07:13:53.7470000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 525 to 526.

Reason SessionUnlock 

BootId: 49 

Event[7413]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T07:13:55.6500000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 526 to 528.

Reason InputHid 

BootId: 49 

Event[7414]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T07:14:58.6740000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 528 to 529.

Reason SessionUnlock 

BootId: 49 

Event[7415]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T07:15:26.5460000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 529 to 531.

Reason InputHid 

BootId: 49 

Event[7416]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T07:16:40.5670000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 531 to 532.

Reason SessionUnlock 

BootId: 49 

Event[7417]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T07:18:43.8510000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86602 seconds since the last report. 

Event[7418]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T07:18:43.8830000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86602 seconds since the last report. 

Event[7419]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T07:18:43.8830000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86602 seconds since the last report. 

Event[7420]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T07:18:43.8830000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86602 seconds since the last report. 

Event[7421]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T07:18:43.8830000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86602 seconds since the last report. 

Event[7422]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T07:18:43.8830000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86602 seconds since the last report. 

Event[7423]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T07:18:43.8830000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86602 seconds since the last report. 

Event[7424]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T07:18:43.8830000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 86602 seconds since the last report. 

Event[7425]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T07:19:14.3300000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[7426]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T07:19:14.3300000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[7427]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T07:23:49.0140000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 532 to 534.

Reason InputHid 

BootId: 49 

Event[7428]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T07:24:50.0150000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 534 to 535.

Reason SessionUnlock 

BootId: 49 

Event[7429]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T07:26:06.7510000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 535 to 537.

Reason InputHid 

BootId: 49 

Event[7430]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T07:27:07.7520000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 537 to 538.

Reason SessionUnlock 

BootId: 49 

Event[7431]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T07:32:02.7090000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 538 to 540.

Reason InputHid 

BootId: 49 

Event[7432]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T07:33:03.7160000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 540 to 541.

Reason SessionUnlock 

BootId: 49 

Event[7433]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-15T07:38:26.5890000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[7434]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-15T07:38:26.5890000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.439.181.0) - Current Channel (Broad) 

Event[7435]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-15T07:38:38.6420000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.439.181.0) - Current Channel (Broad) 

Event[7436]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T07:40:19.2790000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 541 to 543.

Reason InputHid 

BootId: 49 

Event[7437]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T07:41:19.3120000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 543 to 544.

Reason SessionUnlock 

BootId: 49 

Event[7438]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T07:45:54.5510000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 544 to 546.

Reason InputAccelerometer 

BootId: 49 

Event[7439]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-15T08:07:56.3830000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[7440]
  Log Name: System
  Source: Microsoft-Windows-UserModePowerService
  Date: 2025-10-15T08:10:05.9850000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Process C:\Windows\ImmersiveControlPanel\SystemSettings.exe (process ID:12412) reset policy scheme from {381b4222-f694-41f0-9685-ff5bb260df2e} to {381b4222-f694-41f0-9685-ff5bb260df2e} 

Event[7441]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-15T08:10:06.4740000Z
  Event ID: 44
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Download,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Windows Update started downloading an update. 

Event[7442]
  Log Name: System
  Source: Microsoft-Windows-UserModePowerService
  Date: 2025-10-15T08:10:28.2700000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Process C:\Windows\ImmersiveControlPanel\SystemSettings.exe (process ID:12412) reset policy scheme from {381b4222-f694-41f0-9685-ff5bb260df2e} to {381b4222-f694-41f0-9685-ff5bb260df2e} 

Event[7443]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:11:03.0500000Z
  Event ID: 187
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
User-mode process attempted to change the system state by calling SetSuspendState or SetSystemPowerState APIs. 

Event[7444]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:11:03.0650000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 546 to 547.

Reason InputAccelerometer 

BootId: 49 

Event[7445]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:11:04.1250000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: Application API 

Event[7446]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:11:05.3660000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7447]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T08:11:08.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T04:11:08.500000000Z from ?2025?-?10?-?15T04:11:05.366921500Z.
Time Delta: 3133 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T08:11:08.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7448]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:11:08.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 57, FullResume: 694, AverageResume: 700 

Event[7449]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:11:08.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 89581941, SuspendEnd: 89581941 

Event[7450]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:11:08.6730000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 547 to 548.

Reason SxTransition 

BootId: 49 

Event[7451]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-15T08:11:09.0650000Z
  Event ID: 43
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Started, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Started: Windows has started installing the following update: Update for Windows Security platform - KB5007651 (Version 10.0.29429.1000) 

Event[7452]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:11:09.3750000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 548 to 550.

Reason Unknown 

BootId: 49 

Event[7453]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T08:11:09.7220000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T04:11:03.049712200Z
Wake Time: ?2025?-?10?-?15T04:11:08.674554200Z

Wake Source: Power Button 

Event[7454]
  Log Name: System
  Source: Microsoft-Windows-WindowsUpdateClient
  Date: 2025-10-15T08:11:10.3280000Z
  Event ID: 19
  Task: Windows Update Agent 
  Level: Information 
  Opcode: Installation  
  Keyword: Installation,Success, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Installation Successful: Windows successfully installed the following update: Update for Windows Security platform - KB5007651 (Version 10.0.29429.1000) 

Event[7455]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T08:11:45.3450000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.SecHealthUI_1000.29429.1000.0_x64__8wekyb3d8bbwe\ActivationStore.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[7456]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T08:11:45.4680000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.SecHealthUI_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[7457]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:12:57.0680000Z
  Event ID: 187
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
User-mode process attempted to change the system state by calling SetSuspendState or SetSystemPowerState APIs. 

Event[7458]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:12:57.0830000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 550 to 551.

Reason Unknown 

BootId: 49 

Event[7459]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:12:58.1680000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: Application API 

Event[7460]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:12:59.3680000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7461]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T08:13:03.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T04:13:03.500000000Z from ?2025?-?10?-?15T04:12:59.368683100Z.
Time Delta: 4131 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T08:13:03.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7462]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:13:03.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 58, FullResume: 686, AverageResume: 700 

Event[7463]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:13:03.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 89692778, SuspendEnd: 89692778 

Event[7464]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:13:03.6780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 551 to 552.

Reason SxTransition 

BootId: 49 

Event[7465]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:13:04.3910000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 552 to 554.

Reason Unknown 

BootId: 49 

Event[7466]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T08:13:04.7370000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T04:12:57.069120700Z
Wake Time: ?2025?-?10?-?15T04:13:03.675468900Z

Wake Source: Power Button 

Event[7467]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:13:11.6790000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[7468]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:13:16.3160000Z
  Event ID: 187
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User-mode process attempted to change the system state by calling SetSuspendState or SetSystemPowerState APIs. 

Event[7469]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:13:16.3170000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 554 to 555.

Reason Unknown 

BootId: 49 

Event[7470]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:13:19.6580000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: Application API 

Event[7471]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:13:21.2430000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7472]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T08:13:24.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T04:13:24.500000000Z from ?2025?-?10?-?15T04:13:21.243499200Z.
Time Delta: 3256 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T08:13:24.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7473]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:13:24.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 59, FullResume: 697, AverageResume: 700 

Event[7474]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:13:24.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 89710526, SuspendEnd: 89710527 

Event[7475]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:13:24.6850000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 555 to 556.

Reason SxTransition 

BootId: 49 

Event[7476]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:13:25.4150000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 556 to 558.

Reason Unknown 

BootId: 49 

Event[7477]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T08:13:25.7180000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T04:13:16.316869000Z
Wake Time: ?2025?-?10?-?15T04:13:24.673825200Z

Wake Source: Power Button 

Event[7478]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:13:34.5530000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[7479]
  Log Name: System
  Source: Microsoft-Windows-UserModePowerService
  Date: 2025-10-15T08:21:02.6830000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Process C:\Windows\explorer.exe (process ID:15292) reset policy scheme from {381b4222-f694-41f0-9685-ff5bb260df2e} to {381b4222-f694-41f0-9685-ff5bb260df2e} 

Event[7480]
  Log Name: System
  Source: Microsoft-Windows-UserModePowerService
  Date: 2025-10-15T08:22:21.3810000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Process C:\Windows\System32\rundll32.exe (process ID:12080) reset policy scheme from {381b4222-f694-41f0-9685-ff5bb260df2e} to {381b4222-f694-41f0-9685-ff5bb260df2e} 

Event[7481]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:22:39.3130000Z
  Event ID: 187
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
User-mode process attempted to change the system state by calling SetSuspendState or SetSystemPowerState APIs. 

Event[7482]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:22:39.3260000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 558 to 559.

Reason Unknown 

BootId: 49 

Event[7483]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:22:40.4150000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: Application API 

Event[7484]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:22:43.9230000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7485]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T08:22:47.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T04:22:47.500000000Z from ?2025?-?10?-?15T04:22:43.923823600Z.
Time Delta: 3576 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T08:22:47.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7486]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:22:47.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 60, FullResume: 726, AverageResume: 701 

Event[7487]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:22:47.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 90269729, SuspendEnd: 90269730 

Event[7488]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:22:47.6760000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 559 to 560.

Reason SxTransition 

BootId: 49 

Event[7489]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:22:48.3820000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 560 to 562.

Reason Unknown 

BootId: 49 

Event[7490]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T08:22:48.7000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T04:22:39.314026800Z
Wake Time: ?2025?-?10?-?15T04:22:47.670108800Z

Wake Source: Power Button 

Event[7491]
  Log Name: System
  Source: Microsoft-Windows-UserModePowerService
  Date: 2025-10-15T08:24:09.2550000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Process C:\Windows\System32\rundll32.exe (process ID:12440) reset policy scheme from {381b4222-f694-41f0-9685-ff5bb260df2e} to {381b4222-f694-41f0-9685-ff5bb260df2e} 

Event[7492]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:24:15.7370000Z
  Event ID: 187
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
User-mode process attempted to change the system state by calling SetSuspendState or SetSystemPowerState APIs. 

Event[7493]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:24:15.7490000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 562 to 563.

Reason Unknown 

BootId: 49 

Event[7494]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:24:17.0710000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: Application API 

Event[7495]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:24:18.9690000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7496]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T08:24:28.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T04:24:28.500000000Z from ?2025?-?10?-?15T04:24:18.969085900Z.
Time Delta: 9530 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T08:24:28.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7497]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:24:28.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 61, FullResume: 699, AverageResume: 701 

Event[7498]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:24:28.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 90366668, SuspendEnd: 90366669 

Event[7499]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:24:28.6830000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 563 to 564.

Reason SxTransition 

BootId: 49 

Event[7500]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:24:29.4600000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 564 to 566.

Reason Unknown 

BootId: 49 

Event[7501]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T08:24:29.7000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T04:24:15.736502200Z
Wake Time: ?2025?-?10?-?15T04:24:28.678232900Z

Wake Source: Power Button 

Event[7502]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:30:13.9950000Z
  Event ID: 187
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
User-mode process attempted to change the system state by calling SetSuspendState or SetSystemPowerState APIs. 

Event[7503]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:30:14.0090000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 566 to 567.

Reason Unknown 

BootId: 49 

Event[7504]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:30:15.2000000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: Application API 

Event[7505]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:30:16.8240000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7506]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T08:30:25.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T04:30:25.500000000Z from ?2025?-?10?-?15T04:30:16.824505500Z.
Time Delta: 8675 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T08:30:25.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7507]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:30:25.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 62, FullResume: 677, AverageResume: 700 

Event[7508]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:30:25.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 90714811, SuspendEnd: 90714811 

Event[7509]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:30:25.6850000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 567 to 568.

Reason SxTransition 

BootId: 49 

Event[7510]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:30:26.3860000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 568 to 570.

Reason Unknown 

BootId: 49 

Event[7511]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T08:30:26.7000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T04:30:13.987502400Z
Wake Time: ?2025?-?10?-?15T04:30:25.671332200Z

Wake Source: Power Button 

Event[7512]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:33:14.6410000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 570 to 571.

Reason Unknown 

BootId: 49 

Event[7513]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:33:15.8210000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: Button or Lid 

Event[7514]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:33:17.4180000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7515]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T08:33:26.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T04:33:26.500000000Z from ?2025?-?10?-?15T04:33:17.418159400Z.
Time Delta: 9081 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T08:33:26.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7516]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:33:26.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 63, FullResume: 697, AverageResume: 700 

Event[7517]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:33:26.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 90886900, SuspendEnd: 90886900 

Event[7518]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:33:26.6800000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 571 to 572.

Reason SxTransition 

BootId: 49 

Event[7519]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:33:27.4040000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 572 to 574.

Reason Unknown 

BootId: 49 

Event[7520]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T08:33:27.7120000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T04:33:14.628521500Z
Wake Time: ?2025?-?10?-?15T04:33:26.673434500Z

Wake Source: Power Button 

Event[7521]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:40:56.9320000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 574 to 575.

Reason SessionUnlock 

BootId: 49 

Event[7522]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:45:56.0940000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 575 to 577.

Reason InputHid 

BootId: 49 

Event[7523]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:46:51.5380000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 577 to 578.

Reason InputHid 

BootId: 49 

Event[7524]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:46:52.7540000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: Button or Lid 

Event[7525]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:46:54.3050000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7526]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T08:47:03.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T04:47:03.500000000Z from ?2025?-?10?-?15T04:46:54.304802100Z.
Time Delta: 9195 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T08:47:03.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7527]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:47:03.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 64, FullResume: 708, AverageResume: 700 

Event[7528]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:47:03.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 91694453, SuspendEnd: 91694454 

Event[7529]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:47:03.6770000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 578 to 579.

Reason SxTransition 

BootId: 49 

Event[7530]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:47:04.4010000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 579 to 581.

Reason Unknown 

BootId: 49 

Event[7531]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T08:47:04.7020000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T04:46:51.525536300Z
Wake Time: ?2025?-?10?-?15T04:47:03.669280700Z

Wake Source: Power Button 

Event[7532]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:48:04.4750000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 581 to 582.

Reason SessionUnlock 

BootId: 49 

Event[7533]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:55:47.5190000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 582 to 584.

Reason InputHid 

BootId: 49 

Event[7534]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:56:48.5730000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 584 to 585.

Reason SessionUnlock 

BootId: 49 

Event[7535]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T08:57:41.7780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 585 to 587.

Reason InputAccelerometer 

BootId: 49 

Event[7536]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T09:14:14.6710000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume ?? (\Device\HarddiskVolumeShadowCopy6) is healthy.  No action is needed. 

Event[7537]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T09:15:57.9830000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume ?? (\Device\HarddiskVolumeShadowCopy7) is healthy.  No action is needed. 

Event[7538]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T09:17:01.4200000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume ?? (\Device\HarddiskVolumeShadowCopy8) is healthy.  No action is needed. 

Event[7539]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T09:17:17.9800000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  Intel(R) Driver & Support Assistant
Service File Name:  "C:\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAService.exe"
Service Type:  user mode service
Service Start Type:  auto start
Service Account:  LocalSystem 

Event[7540]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T09:17:17.9800000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  Intel(R) Driver & Support Assistant Updater
Service File Name:  "C:\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAUpdateService.exe"
Service Type:  user mode service
Service Start Type:  auto start
Service Account:  LocalSystem 

Event[7541]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T09:17:25.0950000Z
  Event ID: 111
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events triggered on a URL group, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Create URL group 0xFE00000520000001. Status 0x0. Process Id 0x36CC Executable path \Device\HarddiskVolume3\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAService.exe, User S-1-5-18 

Event[7542]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T09:17:25.0960000Z
  Event ID: 113
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events triggered on a URL group, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to add URL (http://127.0.0.1:28390:127.0.0.1/) to URL group (0xFE00000520000001). Status: 0x0. Process Id 0x36CC Executable path \Device\HarddiskVolume3\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAService.exe, User S-1-5-18 

Event[7543]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T09:17:25.3200000Z
  Event ID: 111
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events triggered on a URL group, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Create URL group 0xFE00000020000001. Status 0x0. Process Id 0x36CC Executable path \Device\HarddiskVolume3\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAService.exe, User S-1-5-18 

Event[7544]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T09:17:25.3210000Z
  Event ID: 113
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events triggered on a URL group, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to add URL (http://127.0.0.1:28385:127.0.0.1/intel/) to URL group (0xFE00000020000001). Status: 0x0. Process Id 0x36CC Executable path \Device\HarddiskVolume3\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAService.exe, User S-1-5-18 

Event[7545]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T09:17:30.3230000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume ?? (\Device\HarddiskVolumeShadowCopy9) is healthy.  No action is needed. 

Event[7546]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T09:25:25.1620000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 587 to 588.

Reason SessionUnlock 

BootId: 49 

Event[7547]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T09:33:05.5160000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 588 to 590.

Reason InputHid 

BootId: 49 

Event[7548]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T09:40:20.8010000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  Lenovo Virtual Power Controller Driver
Service File Name:  \SystemRoot\System32\drivers\AcpiVpc.sys
Service Type:  kernel mode driver
Service Start Type:  demand start
Service Account:   

Event[7549]
  Log Name: System
  Source: User32
  Date: 2025-10-15T09:40:35.6190000Z
  Event ID: 1073
  Task: N/A
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The attempt by user 256GB-SSD\aaron to restart/shutdown computer 256GB-SSD failed 

Event[7550]
  Log Name: System
  Source: User32
  Date: 2025-10-15T09:40:55.3850000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the restart of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: restart
 Comment:  

Event[7551]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-15T09:40:56.0970000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[7552]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T09:40:58.2340000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[7553]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-15T09:40:57.8840000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[7554]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T09:40:58.1270000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[7555]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T09:40:58.2080000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[7556]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T09:40:58.2090000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[7557]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T09:40:58.2100000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[7558]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T09:40:58.2100000Z
  Event ID: 51057
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service stop is almost done.DHCP Context Ref count is 1 

Event[7559]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T09:40:58.2110000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[7560]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T09:40:58.2250000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[7561]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T09:41:13.5670000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[7562]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T09:41:13.5670000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[7563]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T09:41:13.5680000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[7564]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T09:40:58.9310000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[7565]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T09:40:58.9530000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[7566]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T09:40:58.9620000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Reboot 
Event Code: 0x0 
Reason: Kernel API 

Event[7567]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T09:40:59.1310000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[7568]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T09:40:59.1310000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[7569]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T09:41:01.5030000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[7570]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T09:41:01.8250000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?15T05:41:01.825407300Z. 

Event[7571]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T09:41:08.8960000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?15T05:41:08.500000000Z. 

Event[7572]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T09:41:08.8960000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?15T05:41:08.500000000Z. 

Loader time: ?2025?-?10?-?15T05:41:07.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[7573]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T09:41:08.8970000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[7574]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T09:41:08.8970000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[7575]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T09:41:08.8970000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[7576]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T09:41:08.8970000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[7577]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T09:41:08.8970000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[7578]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T09:41:08.8970000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?15T09:41:07.000000000Z. 

Event[7579]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T09:41:08.8970000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[7580]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T09:41:08.8970000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[7581]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T09:41:08.9010000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[7582]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T09:41:08.9010000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[7583]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-15T09:41:08.9470000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[7584]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-15T09:41:09.1100000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[7585]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T09:41:09.3350000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T05:29:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7586]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T09:41:09.3360000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T06:58:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7587]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T09:41:09.3380000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T13:57:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7588]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T09:41:09.7010000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[7589]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T09:41:09.7840000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T02:07:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7590]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T09:41:09.7890000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T02:42:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7591]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T09:41:09.8960000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T13:13:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7592]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T09:41:09.9290000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[7593]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T09:41:09.9290000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[7594]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T09:41:09.9300000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[7595]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-15T09:41:10.4560000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[7596]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T09:41:10.4980000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[7597]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T09:41:10.5070000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[7598]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T09:41:10.5150000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[7599]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T09:41:10.5160000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[7600]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T09:41:10.5300000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[7601]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T09:41:10.5310000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[7602]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T09:41:10.5320000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[7603]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-15T09:41:10.5390000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[7604]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T09:41:10.5500000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[7605]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T09:41:10.5540000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[7606]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T09:41:10.6310000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[7607]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T09:41:11.0560000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[7608]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T09:41:11.2350000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[7609]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T09:41:11.3030000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -240. 

Event[7610]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T09:41:12.0360000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[7611]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T09:41:12.0360000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[7612]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T09:41:12.0360000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[7613]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T09:41:12.0380000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[7614]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T09:41:12.1650000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[7615]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T09:41:12.1670000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[7616]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-15T09:41:12.2240000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[7617]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T09:41:12.4560000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[7618]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T09:41:12.4660000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[7619]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T09:41:12.4660000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[7620]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T09:41:13.4110000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T17:49:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7621]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T09:41:13.4170000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T18:58:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7622]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T09:41:13.4280000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T06:02:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7623]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T09:41:13.4460000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T15:27:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7624]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T09:41:13.4630000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7625]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T09:41:13.4630000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T01:25:34.000000000Z) unloaded successfully. 

Event[7626]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T09:41:13.4630000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7627]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T09:41:13.4690000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T15:01:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7628]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T09:41:13.4750000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T14:47:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7629]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T09:41:13.4820000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T07:53:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7630]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T09:41:13.8590000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[7631]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T09:41:13.8590000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[7632]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T09:41:13.8590000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[7633]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T09:41:13.8940000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[7634]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-15T09:41:14.0650000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[7635]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T09:41:14.1070000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7636]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T09:41:14.1070000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7637]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T09:41:14.1070000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7638]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T09:41:14.1070000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7639]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T09:41:14.1070000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7640]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T09:41:14.1070000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7641]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T09:41:14.1070000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7642]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T09:41:14.1070000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7643]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T09:41:14.1070000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7644]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T09:41:14.1070000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7645]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T09:41:14.1070000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7646]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T09:41:14.1070000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7647]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T09:41:14.1070000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7648]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T09:41:14.1070000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7649]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T09:41:14.5410000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[7650]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T09:41:16.4160000Z
  Event ID: 111
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events triggered on a URL group, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Create URL group 0xFE00000320000001. Status 0x0. Process Id 0xE8C Executable path \Device\HarddiskVolume3\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAService.exe, User S-1-5-18 

Event[7651]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T09:41:16.4170000Z
  Event ID: 113
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events triggered on a URL group, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to add URL (http://127.0.0.1:28390:127.0.0.1/) to URL group (0xFE00000320000001). Status: 0x0. Process Id 0xE8C Executable path \Device\HarddiskVolume3\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAService.exe, User S-1-5-18 

Event[7652]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T09:41:16.4290000Z
  Event ID: 111
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events triggered on a URL group, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Create URL group 0xFE00000020000001. Status 0x0. Process Id 0xE8C Executable path \Device\HarddiskVolume3\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAService.exe, User S-1-5-18 

Event[7653]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T09:41:16.4290000Z
  Event ID: 113
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events triggered on a URL group, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to add URL (http://127.0.0.1:28385:127.0.0.1/intel/) to URL group (0xFE00000020000001). Status: 0x0. Process Id 0xE8C Executable path \Device\HarddiskVolume3\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAService.exe, User S-1-5-18 

Event[7654]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T09:41:17.0040000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[7655]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T09:41:17.1320000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[7656]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T09:41:17.1340000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000050-0000000000.json for detailed information on what checks were made. 

Event[7657]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T09:41:17.1580000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[7658]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T09:41:17.2150000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[7659]
  Log Name: System
  Source: TPM
  Date: 2025-10-15T09:41:19.2410000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[7660]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T09:41:20.6380000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\SystemAppData\Helium\User.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[7661]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T09:41:20.6550000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WidgetsPlatformRuntime_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat was cleared updating 15 keys and creating 5 modified pages. 

Event[7662]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T09:41:21.9920000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[7663]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T09:41:23.7590000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[7664]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T09:41:24.5650000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[7665]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T09:41:35.3590000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\AppleInc.iTunes_nzyj5cx40ttqa\SystemAppData\Helium\User.dat was cleared updating 17 keys and creating 2 modified pages. 

Event[7666]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T09:41:35.3650000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\AppleInc.iTunes_nzyj5cx40ttqa\SystemAppData\Helium\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[7667]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T09:42:21.6550000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[7668]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T09:42:21.6710000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[7669]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T09:42:21.6720000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[7670]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T09:42:21.6880000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[7671]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T09:42:21.6880000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[7672]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T09:42:21.6880000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[7673]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T09:42:21.6880000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[7674]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T09:42:21.7040000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[7675]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T09:43:01.5830000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 0 to 1.

Reason SessionUnlock 

BootId: 50 

Event[7676]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T09:43:18.6510000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[7677]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T09:43:18.6510000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[7678]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T09:43:28.9720000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start. 

Event[7679]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-15T09:43:50.3000000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[7680]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T09:45:08.8890000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 1 to 3.

Reason InputHid 

BootId: 50 

Event[7681]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T09:46:11.0090000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 3 to 4.

Reason SessionUnlock 

BootId: 50 

Event[7682]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T09:46:14.0700000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[7683]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T09:46:14.0700000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[7684]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T09:46:22.9450000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 4 to 6.

Reason InputHid 

BootId: 50 

Event[7685]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T09:48:26.2150000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[7686]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T09:48:26.2190000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[7687]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T09:48:26.2190000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[7688]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T09:48:26.2210000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[7689]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T09:52:30.7400000Z
  Event ID: 187
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
User-mode process attempted to change the system state by calling SetSuspendState or SetSystemPowerState APIs. 

Event[7690]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T09:52:30.7560000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 6 to 7.

Reason InputHid 

BootId: 50 

Event[7691]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T09:52:32.0110000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: Application API 

Event[7692]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T09:52:33.0650000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[7693]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T09:52:33.6070000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7694]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T09:52:40.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T05:52:40.500000000Z from ?2025?-?10?-?15T05:52:33.607808900Z.
Time Delta: 6892 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T09:52:40.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7695]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T09:52:40.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 1, FullResume: 714, AverageResume: 714 

Event[7696]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T09:52:40.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 692531, SuspendEnd: 692531 

Event[7697]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T09:52:40.6770000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 7 to 8.

Reason SxTransition 

BootId: 50 

Event[7698]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T09:52:41.3960000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 8 to 10.

Reason Unknown 

BootId: 50 

Event[7699]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T09:52:41.6870000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T05:52:30.739386800Z
Wake Time: ?2025?-?10?-?15T05:52:40.676583700Z

Wake Source: Power Button 

Event[7700]
  Log Name: System
  Source: Microsoft-Windows-WHEA-Logger
  Date: 2025-10-15T09:52:41.6970000Z
  Event ID: 17
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
A corrected hardware error has occurred.

Component: PCI Express Root Port
Error Source: Advanced Error Reporting (PCI Express)

Primary Bus:Device:Function: 0x0:0x1C:0x0
Secondary Bus:Device:Function: 0x0:0x0:0x0
Primary Device Name:PCI\VEN_8086&DEV_A111&SUBSYS_380217AA&REV_F1
Secondary Device Name: 

Event[7701]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:02:26.4150000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 10 to 11.

Reason SessionUnlock 

BootId: 50 

Event[7702]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:05:10.2340000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 11 to 13.

Reason InputHid 

BootId: 50 

Event[7703]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T10:05:42.6910000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[7704]
  Log Name: System
  Source: Microsoft-Windows-UserModePowerService
  Date: 2025-10-15T10:15:40.4740000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Process C:\Windows\System32\dllhost.exe (process ID:2936) reset policy scheme from {381b4222-f694-41f0-9685-ff5bb260df2e} to {381b4222-f694-41f0-9685-ff5bb260df2e} 

Event[7705]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:16:01.8830000Z
  Event ID: 187
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
User-mode process attempted to change the system state by calling SetSuspendState or SetSystemPowerState APIs. 

Event[7706]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:16:01.8990000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 13 to 14.

Reason InputHid 

BootId: 50 

Event[7707]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:16:03.2410000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: Application API 

Event[7708]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:16:04.7510000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7709]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T10:16:34.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T06:16:34.500000000Z from ?2025?-?10?-?15T06:16:04.751361000Z.
Time Delta: 29748 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T10:16:34.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7710]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T10:16:34.7090000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[7711]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T10:16:34.7100000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x0. 

Event[7712]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T10:16:34.7100000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The boot type was 0x2. 

Event[7713]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T10:16:34.7100000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[7714]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T10:16:34.7100000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[7715]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T10:16:34.7100000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[7716]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:16:34.7110000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 14 to 15.

Reason SxTransition 

BootId: 50 

Event[7717]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:16:35.2020000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 15 to 17.

Reason WinRT 

BootId: 50 

Event[7718]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T10:16:35.4930000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[7719]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T10:16:35.4930000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000050-0000000001.json for detailed information on what checks were made. 

Event[7720]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T10:16:35.8470000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T06:16:01.877587400Z
Wake Time: ?2025?-?10?-?15T06:16:34.722136400Z

Wake Source: Unknown 

Event[7721]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:16:46.7270000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[7722]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:16:58.6610000Z
  Event ID: 187
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
User-mode process attempted to change the system state by calling SetSuspendState or SetSystemPowerState APIs. 

Event[7723]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:16:58.6750000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 17 to 18.

Reason WinRT 

BootId: 50 

Event[7724]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:17:02.4510000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: Application API 

Event[7725]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:17:03.9990000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7726]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T10:17:10.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T06:17:10.500000000Z from ?2025?-?10?-?15T06:17:03.999284500Z.
Time Delta: 6500 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T10:17:10.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7727]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:17:10.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 1, FullResume: 706, AverageResume: 706 

Event[7728]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:17:10.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 2128803, SuspendEnd: 2128804 

Event[7729]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:17:10.6810000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 18 to 19.

Reason SxTransition 

BootId: 50 

Event[7730]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:17:11.4030000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 19 to 21.

Reason Unknown 

BootId: 50 

Event[7731]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T10:17:11.6970000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T06:16:58.657517600Z
Wake Time: ?2025?-?10?-?15T06:17:10.664456800Z

Wake Source: Power Button 

Event[7732]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-15T10:17:23.5420000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[7733]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:18:31.9820000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 21 to 22.

Reason Unknown 

BootId: 50 

Event[7734]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:18:35.8320000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: Button or Lid 

Event[7735]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:18:37.6840000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7736]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T10:18:44.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T06:18:44.500000000Z from ?2025?-?10?-?15T06:18:37.684762000Z.
Time Delta: 6815 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T10:18:44.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7737]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:18:44.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 2, FullResume: 695, AverageResume: 700 

Event[7738]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:18:44.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 2216145, SuspendEnd: 2216145 

Event[7739]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:18:44.6820000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 22 to 23.

Reason SxTransition 

BootId: 50 

Event[7740]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:18:45.3780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 23 to 25.

Reason Unknown 

BootId: 50 

Event[7741]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T10:18:45.7080000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T06:18:31.969769900Z
Wake Time: ?2025?-?10?-?15T06:18:44.677297600Z

Wake Source: Power Button 

Event[7742]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:30:04.0250000Z
  Event ID: 187
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
User-mode process attempted to change the system state by calling SetSuspendState or SetSystemPowerState APIs. 

Event[7743]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:30:04.0390000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 25 to 26.

Reason Unknown 

BootId: 50 

Event[7744]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:30:07.7270000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: Application API 

Event[7745]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:30:09.5670000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7746]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T10:30:16.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T06:30:16.500000000Z from ?2025?-?10?-?15T06:30:09.567679200Z.
Time Delta: 6932 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T10:30:16.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7747]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:30:16.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 3, FullResume: 701, AverageResume: 700 

Event[7748]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:30:16.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 2900631, SuspendEnd: 2900632 

Event[7749]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:30:16.6780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 26 to 27.

Reason SxTransition 

BootId: 50 

Event[7750]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:30:17.3800000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 27 to 29.

Reason Unknown 

BootId: 50 

Event[7751]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T10:30:17.6980000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T06:30:04.014974100Z
Wake Time: ?2025?-?10?-?15T06:30:16.669139700Z

Wake Source: Power Button 

Event[7752]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:30:30.3630000Z
  Event ID: 105
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Power source change. 

Event[7753]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-15T10:30:30.5060000Z
  Event ID: 4068
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity initiated by DoSvc 

Event[7754]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-15T10:35:17.5710000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name t-s2-ring.msedge.net timed out after none of the configured DNS servers responded. Client PID 9920. 

Event[7755]
  Log Name: System
  Source: Microsoft-Windows-Iphlpsvc-Trace
  Date: 2025-10-15T10:36:15.5880000Z
  Event ID: 4071
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Teredo connectivity ended by DoSvc 

Event[7756]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:42:00.3970000Z
  Event ID: 187
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
User-mode process attempted to change the system state by calling SetSuspendState or SetSystemPowerState APIs. 

Event[7757]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:42:00.4130000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 29 to 30.

Reason Unknown 

BootId: 50 

Event[7758]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:42:01.6490000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: Application API 

Event[7759]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:42:03.0830000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7760]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T10:42:09.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T06:42:09.500000000Z from ?2025?-?10?-?15T06:42:03.082776500Z.
Time Delta: 6417 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T10:42:09.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7761]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:42:09.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 4, FullResume: 694, AverageResume: 699 

Event[7762]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:42:09.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 3606242, SuspendEnd: 3606243 

Event[7763]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:42:09.6790000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 30 to 31.

Reason SxTransition 

BootId: 50 

Event[7764]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T10:42:10.4330000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 31 to 33.

Reason Unknown 

BootId: 50 

Event[7765]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T10:42:10.7070000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T06:42:00.397463900Z
Wake Time: ?2025?-?10?-?15T06:42:09.673236400Z

Wake Source: Power Button 

Event[7766]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T11:06:14.1700000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 33 to 34.

Reason SessionUnlock 

BootId: 50 

Event[7767]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T11:07:39.3070000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 34 to 36.

Reason InputHid 

BootId: 50 

Event[7768]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T11:16:32.0510000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[7769]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T11:21:54.8580000Z
  Event ID: 187
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
User-mode process attempted to change the system state by calling SetSuspendState or SetSystemPowerState APIs. 

Event[7770]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T11:21:54.8750000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 36 to 37.

Reason InputHid 

BootId: 50 

Event[7771]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T11:21:58.1230000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: Application API 

Event[7772]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T11:21:59.5690000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7773]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T11:22:06.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T07:22:06.500000000Z from ?2025?-?10?-?15T07:21:59.568818000Z.
Time Delta: 6931 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T11:22:06.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7774]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T11:22:06.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 5, FullResume: 697, AverageResume: 698 

Event[7775]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T11:22:06.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 5995239, SuspendEnd: 5995239 

Event[7776]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T11:22:06.6770000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 37 to 38.

Reason SxTransition 

BootId: 50 

Event[7777]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T11:22:07.3770000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 38 to 40.

Reason Unknown 

BootId: 50 

Event[7778]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T11:22:07.6960000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T07:21:54.858789700Z
Wake Time: ?2025?-?10?-?15T07:22:06.668876600Z

Wake Source: Power Button 

Event[7779]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-15T11:57:32.2960000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[7780]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T12:00:00.6310000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 8332 seconds. 

Event[7781]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-15T12:18:50.3070000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name arm-ring.msedge.net timed out after none of the configured DNS servers responded. Client PID 9920. 

Event[7782]
  Log Name: System
  Source: Microsoft-Windows-UserModePowerService
  Date: 2025-10-15T12:26:22.6800000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Process C:\Windows\System32\dllhost.exe (process ID:7252) reset policy scheme from {381b4222-f694-41f0-9685-ff5bb260df2e} to {381b4222-f694-41f0-9685-ff5bb260df2e} 

Event[7783]
  Log Name: System
  Source: Microsoft-Windows-UserModePowerService
  Date: 2025-10-15T12:26:33.0810000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Process C:\Windows\System32\dllhost.exe (process ID:7252) reset policy scheme from {381b4222-f694-41f0-9685-ff5bb260df2e} to {381b4222-f694-41f0-9685-ff5bb260df2e} 

Event[7784]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T12:33:34.7740000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 40 to 41.

Reason SessionUnlock 

BootId: 50 

Event[7785]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T12:35:29.4980000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 41 to 43.

Reason InputHid 

BootId: 50 

Event[7786]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T12:37:37.1500000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  iscFlash
Service File Name:  C:\Users\aaron\AppData\Local\Temp\7zS8F50.tmp\iscflashx64.sys
Service Type:  kernel mode driver
Service Start Type:  demand start
Service Account:   

Event[7787]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T12:43:38.6280000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\SystemAppData\Helium\User.dat was cleared updating 7 keys and creating 1 modified pages. 

Event[7788]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T12:43:38.6340000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat was cleared updating 5 keys and creating 1 modified pages. 

Event[7789]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T12:46:10.5560000Z
  Event ID: 187
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
User-mode process attempted to change the system state by calling SetSuspendState or SetSystemPowerState APIs. 

Event[7790]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T12:46:10.5690000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 43 to 44.

Reason InputHid 

BootId: 50 

Event[7791]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T12:46:11.7680000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: Application API 

Event[7792]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T12:46:13.3170000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[7793]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T12:46:22.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T08:46:22.500000000Z from ?2025?-?10?-?15T08:46:13.317648200Z.
Time Delta: 9182 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T12:46:22.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[7794]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T12:46:22.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 6, FullResume: 698, AverageResume: 698 

Event[7795]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T12:46:22.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 11038670, SuspendEnd: 11038670 

Event[7796]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T12:46:22.6780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 44 to 45.

Reason SxTransition 

BootId: 50 

Event[7797]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T12:46:23.3970000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 45 to 47.

Reason Unknown 

BootId: 50 

Event[7798]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T12:46:23.7170000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T08:46:10.550506400Z
Wake Time: ?2025?-?10?-?15T08:46:22.685013800Z

Wake Source: Power Button 

Event[7799]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-15T13:00:37.1310000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name amp.akamaized.net timed out after none of the configured DNS servers responded. Client PID 3852. 

Event[7800]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T13:10:20.3900000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start. 

Event[7801]
  Log Name: System
  Source: User32
  Date: 2025-10-15T13:19:00.5560000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the restart of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: restart
 Comment:  

Event[7802]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-15T13:19:01.4130000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[7803]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T13:19:01.9350000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[7804]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T13:19:01.8530000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[7805]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T13:19:01.9190000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[7806]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T13:19:01.9210000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[7807]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T13:19:01.9310000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[7808]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T13:19:01.9340000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[7809]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T13:19:01.9340000Z
  Event ID: 51057
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service stop is almost done.DHCP Context Ref count is 1 

Event[7810]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T13:19:16.5160000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[7811]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T13:19:16.5160000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[7812]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T13:19:16.5170000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[7813]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T13:19:01.9660000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[7814]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T13:19:02.6840000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[7815]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T13:19:02.7190000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[7816]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T13:19:02.7360000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Reboot 
Event Code: 0x0 
Reason: Kernel API 

Event[7817]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T13:19:02.8660000Z
  Event ID: 7038
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The AdskLicensingService service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: 
The request is not supported.

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 

Event[7818]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T13:19:02.8660000Z
  Event ID: 7000
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service failed to start due to the following error: 
The service did not start due to a logon failure. 

Event[7819]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T13:19:05.4100000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[7820]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T13:19:05.5840000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?15T09:19:05.584105500Z. 

Event[7821]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T13:19:11.9100000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?15T09:19:11.500000000Z. 

Event[7822]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T13:19:11.9100000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?15T09:19:11.500000000Z. 

Loader time: ?2025?-?10?-?15T09:19:11.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[7823]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T13:19:11.9100000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[7824]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T13:19:11.9110000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[7825]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T13:19:11.9110000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[7826]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T13:19:11.9110000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[7827]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T13:19:11.9110000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[7828]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T13:19:11.9110000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?15T13:19:11.000000000Z. 

Event[7829]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T13:19:11.9110000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[7830]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T13:19:11.9110000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[7831]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T13:19:11.9150000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[7832]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T13:19:11.9150000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[7833]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-15T13:19:11.9420000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[7834]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-15T13:19:12.1050000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[7835]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T13:19:12.3170000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T05:29:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7836]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T13:19:12.3180000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T06:58:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7837]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T13:19:12.3190000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T13:57:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7838]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T13:19:12.7080000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[7839]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T13:19:12.7930000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T02:07:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7840]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T13:19:12.7980000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T02:42:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7841]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T13:19:12.9060000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T13:13:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7842]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T13:19:12.9400000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[7843]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T13:19:12.9400000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[7844]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T13:19:12.9420000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[7845]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-15T13:19:13.4710000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[7846]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T13:19:13.5140000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[7847]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T13:19:13.5220000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[7848]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T13:19:13.5470000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[7849]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T13:19:13.5480000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[7850]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T13:19:13.5490000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[7851]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T13:19:13.5500000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[7852]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T13:19:13.5510000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[7853]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-15T13:19:13.5540000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[7854]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T13:19:13.6170000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[7855]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T13:19:13.6210000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[7856]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T13:19:13.6890000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[7857]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T13:19:14.0960000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[7858]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T13:19:14.2990000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[7859]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T13:19:14.3690000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -240. 

Event[7860]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T13:19:15.0760000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[7861]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T13:19:15.0760000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[7862]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T13:19:15.0760000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[7863]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T13:19:15.0780000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[7864]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T13:19:15.1780000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[7865]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T13:19:15.1800000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[7866]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-15T13:19:15.2360000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[7867]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T13:19:15.4170000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[7868]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T13:19:15.4290000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[7869]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T13:19:15.4290000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[7870]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T13:19:16.3680000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T18:58:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7871]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T13:19:16.3790000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T06:02:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7872]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T13:19:16.3840000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T17:49:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7873]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T13:19:16.3960000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T15:27:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7874]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T13:19:16.4160000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7875]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T13:19:16.4160000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T01:25:34.000000000Z) unloaded successfully. 

Event[7876]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T13:19:16.4160000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7877]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T13:19:16.4220000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T15:01:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7878]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T13:19:16.4290000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T14:47:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7879]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T13:19:16.4360000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T07:53:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7880]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T13:19:16.7320000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[7881]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T13:19:16.7320000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[7882]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T13:19:16.7320000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[7883]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T13:19:16.7560000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[7884]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T13:19:16.9970000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7885]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T13:19:16.9970000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7886]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T13:19:16.9970000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7887]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T13:19:16.9970000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7888]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T13:19:16.9970000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7889]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T13:19:16.9970000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7890]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T13:19:16.9970000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7891]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T13:19:16.9970000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7892]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T13:19:16.9970000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7893]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T13:19:16.9970000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7894]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T13:19:16.9970000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7895]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T13:19:16.9970000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7896]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T13:19:16.9970000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7897]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T13:19:16.9970000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[7898]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-15T13:19:17.0260000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[7899]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T13:19:17.3800000Z
  Event ID: 7023
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The cphs service terminated with the following error: 
Unspecified error 

Event[7900]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T13:19:19.0890000Z
  Event ID: 111
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events triggered on a URL group, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Create URL group 0xFE00000520000001. Status 0x0. Process Id 0xE88 Executable path \Device\HarddiskVolume3\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAService.exe, User S-1-5-18 

Event[7901]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T13:19:19.0900000Z
  Event ID: 113
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events triggered on a URL group, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to add URL (http://127.0.0.1:28390:127.0.0.1/) to URL group (0xFE00000520000001). Status: 0x0. Process Id 0xE88 Executable path \Device\HarddiskVolume3\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAService.exe, User S-1-5-18 

Event[7902]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T13:19:19.1010000Z
  Event ID: 111
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events triggered on a URL group, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Create URL group 0xFE00000020000001. Status 0x0. Process Id 0xE88 Executable path \Device\HarddiskVolume3\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAService.exe, User S-1-5-18 

Event[7903]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T13:19:19.1010000Z
  Event ID: 113
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events triggered on a URL group, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to add URL (http://127.0.0.1:28385:127.0.0.1/intel/) to URL group (0xFE00000020000001). Status: 0x0. Process Id 0xE88 Executable path \Device\HarddiskVolume3\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAService.exe, User S-1-5-18 

Event[7904]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T13:19:19.3670000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[7905]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T13:19:19.5230000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[7906]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T13:19:19.5690000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[7907]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T13:19:19.7160000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[7908]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T13:19:19.7160000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000051-0000000000.json for detailed information on what checks were made. 

Event[7909]
  Log Name: System
  Source: TPM
  Date: 2025-10-15T13:19:22.2360000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[7910]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T13:19:26.1180000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[7911]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T13:19:27.5430000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[7912]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T13:20:24.6700000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[7913]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T13:20:24.6860000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[7914]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T13:20:24.7020000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[7915]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T13:20:24.7180000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[7916]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T13:20:24.7180000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[7917]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T13:20:24.7180000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[7918]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T13:20:24.7190000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[7919]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T13:20:24.7190000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[7920]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T13:20:26.9700000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 0 to 1.

Reason SessionUnlock 

BootId: 51 

Event[7921]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T13:20:54.5270000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 1 to 3.

Reason InputAccelerometer 

BootId: 51 

Event[7922]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T13:21:25.8980000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscBrokerManager
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[7923]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T13:21:25.8980000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.SecurityAppBroker
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[7924]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T13:21:25.8980000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[7925]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T13:24:17.1240000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[7926]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T13:24:17.1240000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[7927]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T14:10:00.2800000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[7928]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:10:59.6270000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 3 to 4.

Reason SessionUnlock 

BootId: 51 

Event[7929]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:13:05.1310000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 4 to 6.

Reason InputHid 

BootId: 51 

Event[7930]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T14:53:11.9160000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the Realtek Audio Service service was changed from auto start to disabled. 

Event[7931]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T14:53:11.9160000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the iPod Service service was changed from demand start to disabled. 

Event[7932]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T14:53:11.9160000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the Intel(R) HD Graphics Control Panel Service service was changed from auto start to disabled. 

Event[7933]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T14:53:11.9160000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the Intel Bluetooth Service service was changed from auto start to disabled. 

Event[7934]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T14:53:11.9160000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the FlexNet Licensing Service 64 service was changed from auto start to disabled. 

Event[7935]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T14:53:11.9160000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the FlexNet Licensing Service service was changed from auto start to disabled. 

Event[7936]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T14:53:11.9160000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the Intel(R) Driver & Support Assistant Updater service was changed from auto start to disabled. 

Event[7937]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T14:53:11.9160000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the Intel(R) Driver & Support Assistant service was changed from auto start to disabled. 

Event[7938]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T14:53:11.9160000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the DropboxUpdater Service 123.0.6299.129 (DropboxUpdaterService123.0.6299.129) service was changed from auto start to disabled. 

Event[7939]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T14:53:11.9160000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the DropboxUpdater InternalService 123.0.6299.129 (DropboxUpdaterInternalService123.0.6299.129) service was changed from auto start to disabled. 

Event[7940]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T14:53:11.9160000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the Dropbox Elevation Service (DropboxElevationService) service was changed from demand start to disabled. 

Event[7941]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T14:53:11.9160000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the Dolby DAX2 API Service service was changed from auto start to disabled. 

Event[7942]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T14:53:11.9160000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the DbxSvc service was changed from auto start to disabled. 

Event[7943]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T14:53:11.9160000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the Intel(R) Content Protection HDCP Service service was changed from auto start to disabled. 

Event[7944]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T14:53:11.9160000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the Intel(R) Content Protection HECI Service service was changed from demand start to disabled. 

Event[7945]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T14:53:11.9160000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the Brave Update Service (bravem) service was changed from demand start to disabled. 

Event[7946]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T14:53:11.9160000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the Brave Elevation Service (BraveElevationService) service was changed from demand start to disabled. 

Event[7947]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T14:53:11.9160000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the Brave Update Service (brave) service was changed from auto start to disabled. 

Event[7948]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T14:53:11.9310000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the Bonjour Service service was changed from auto start to disabled. 

Event[7949]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T14:53:11.9310000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the Alps HID Monitor Service service was changed from auto start to disabled. 

Event[7950]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T14:53:11.9310000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the Autodesk Desktop Licensing Service service was changed from auto start to disabled. 

Event[7951]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T14:53:11.9310000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The start type of the Autodesk Desktop App Service service was changed from auto start to disabled. 

Event[7952]
  Log Name: System
  Source: User32
  Date: 2025-10-15T14:53:20.4040000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\WINDOWS\system32\msconfig.exe (256GB-SSD) has initiated the restart of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: No title for this reason could be found
 Reason Code: 0x40000
 Shutdown Type: restart
 Comment:  

Event[7953]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-15T14:53:21.1200000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[7954]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T14:53:21.7400000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[7955]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T14:53:21.6780000Z
  Event ID: 7031
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Autodesk Desktop Licensing Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 1000 milliseconds: Restart the service. 

Event[7956]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T14:53:21.7310000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[7957]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T14:53:21.7330000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[7958]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T14:53:21.7360000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[7959]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T14:53:21.7360000Z
  Event ID: 51057
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service stop is almost done.DHCP Context Ref count is 1 

Event[7960]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T14:53:21.7460000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[7961]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T14:53:21.7460000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[7962]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T14:53:36.4400000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[7963]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T14:53:36.4400000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[7964]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T14:53:36.4410000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 4 seconds. 

Event[7965]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T14:53:22.4510000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[7966]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T14:53:22.4640000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[7967]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:53:22.4840000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Reboot 
Event Code: 0x0 
Reason: Kernel API 

Event[7968]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T14:53:22.6830000Z
  Event ID: 7032
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Autodesk Desktop Licensing Service service, but this action failed with the following error: 
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 

Event[7969]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:53:24.7880000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[7970]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T14:53:24.9690000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?15T10:53:24.969286800Z. 

Event[7971]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T14:53:31.8970000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?15T10:53:31.500000000Z. 

Event[7972]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T14:53:31.8970000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?15T10:53:31.500000000Z. 

Loader time: ?2025?-?10?-?15T10:53:30.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[7973]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T14:53:31.8980000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[7974]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T14:53:31.8980000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[7975]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T14:53:31.8980000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[7976]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T14:53:31.8980000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[7977]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T14:53:31.8980000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[7978]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T14:53:31.8980000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?15T14:53:30.000000000Z. 

Event[7979]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T14:53:31.8980000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[7980]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T14:53:31.8980000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[7981]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T14:53:31.9020000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[7982]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T14:53:31.9020000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[7983]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-15T14:53:31.9470000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[7984]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-15T14:53:32.1110000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[7985]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T14:53:32.3370000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T05:29:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7986]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T14:53:32.3380000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T06:58:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7987]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T14:53:32.3400000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T13:57:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7988]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T14:53:32.7180000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[7989]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T14:53:32.8010000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T02:07:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7990]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T14:53:32.8060000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T02:42:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7991]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T14:53:32.9130000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T13:13:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[7992]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:53:32.9470000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[7993]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:53:32.9470000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[7994]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:53:32.9490000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[7995]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-15T14:53:33.4750000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[7996]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T14:53:33.5180000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[7997]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T14:53:33.5560000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[7998]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T14:53:33.5570000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[7999]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T14:53:33.5590000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8000]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T14:53:33.5600000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8001]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T14:53:33.5610000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8002]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-15T14:53:33.5600000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[8003]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T14:53:33.5620000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8004]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T14:53:33.5640000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8005]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:53:33.5680000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[8006]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:53:33.6430000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[8007]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T14:53:34.0720000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[8008]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T14:53:34.2290000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[8009]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T14:53:34.2930000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -240. 

Event[8010]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T14:53:34.9880000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[8011]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T14:53:34.9880000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[8012]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T14:53:34.9880000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[8013]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T14:53:34.9890000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[8014]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T14:53:35.0900000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[8015]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T14:53:35.0910000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[8016]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-15T14:53:35.1460000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[8017]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T14:53:35.3370000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[8018]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T14:53:35.3480000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[8019]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T14:53:35.3480000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[8020]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T14:53:36.2940000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T18:58:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8021]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T14:53:36.3040000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T06:02:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8022]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T14:53:36.3090000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T17:49:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8023]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T14:53:36.3240000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T15:27:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8024]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T14:53:36.3410000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8025]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T14:53:36.3410000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T01:25:34.000000000Z) unloaded successfully. 

Event[8026]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T14:53:36.3410000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8027]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T14:53:36.3470000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T15:01:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8028]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T14:53:36.3570000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T14:47:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8029]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T14:53:36.3640000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T07:53:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8030]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T14:53:36.7510000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[8031]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T14:53:36.7510000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[8032]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T14:53:36.7510000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[8033]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T14:53:36.7720000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[8034]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T14:53:36.9580000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8035]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T14:53:36.9580000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8036]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T14:53:36.9580000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8037]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T14:53:36.9580000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8038]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T14:53:36.9580000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8039]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T14:53:36.9580000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8040]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T14:53:36.9580000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8041]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T14:53:36.9580000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8042]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T14:53:36.9580000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8043]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T14:53:36.9580000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8044]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T14:53:36.9580000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8045]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T14:53:36.9580000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8046]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T14:53:36.9580000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8047]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T14:53:36.9580000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8048]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T14:53:38.6210000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[8049]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T14:53:38.6210000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000052-0000000000.json for detailed information on what checks were made. 

Event[8050]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T14:53:38.7640000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[8051]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T14:53:38.8780000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[8052]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T14:53:38.9090000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[8053]
  Log Name: System
  Source: TPM
  Date: 2025-10-15T14:53:42.2350000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[8054]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T14:53:43.1160000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[8055]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T14:53:43.7460000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[8056]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-15T14:53:44.7670000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[8057]
  Log Name: System
  Source: Microsoft-Windows-UserModePowerService
  Date: 2025-10-15T14:54:27.3190000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Process C:\Windows\System32\dllhost.exe (process ID:2212) reset policy scheme from {381b4222-f694-41f0-9685-ff5bb260df2e} to {381b4222-f694-41f0-9685-ff5bb260df2e} 

Event[8058]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:54:33.8400000Z
  Event ID: 187
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
User-mode process attempted to change the system state by calling SetSuspendState or SetSystemPowerState APIs. 

Event[8059]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:54:33.8520000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 0 to 1.

Reason ScreenOffGracePeriod 

BootId: 52 

Event[8060]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:54:34.5080000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: Application API 

Event[8061]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:54:35.9350000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[8062]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T14:54:39.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T10:54:39.500000000Z from ?2025?-?10?-?15T10:54:35.935548700Z.
Time Delta: 3564 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T14:54:39.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[8063]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:54:39.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 1, FullResume: 715, AverageResume: 715 

Event[8064]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:54:39.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 68864, SuspendEnd: 68864 

Event[8065]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:54:39.6700000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 1 to 2.

Reason SxTransition 

BootId: 52 

Event[8066]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:54:40.3660000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 2 to 4.

Reason Unknown 

BootId: 52 

Event[8067]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T14:54:40.7130000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T10:54:33.833811800Z
Wake Time: ?2025?-?10?-?15T10:54:39.664209200Z

Wake Source: Power Button 

Event[8068]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T14:54:48.2430000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 74 seconds since the last report. 

Event[8069]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T14:54:48.2910000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 74 seconds since the last report. 

Event[8070]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T14:54:48.2910000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 74 seconds since the last report. 

Event[8071]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T14:54:48.2910000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 74 seconds since the last report. 

Event[8072]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T14:54:48.2910000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 74 seconds since the last report. 

Event[8073]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T14:54:48.2920000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 74 seconds since the last report. 

Event[8074]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T14:54:48.2920000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 74 seconds since the last report. 

Event[8075]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T14:54:48.2920000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 74 seconds since the last report. 

Event[8076]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:54:53.5340000Z
  Event ID: 187
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User-mode process attempted to change the system state by calling SetSuspendState or SetSystemPowerState APIs. 

Event[8077]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:54:53.5530000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 4 to 5.

Reason Unknown 

BootId: 52 

Event[8078]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:54:54.5620000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: Application API 

Event[8079]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:54:55.7630000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[8080]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T14:54:59.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T10:54:59.500000000Z from ?2025?-?10?-?15T10:54:55.763252600Z.
Time Delta: 3736 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T14:54:59.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[8081]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:54:59.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 2, FullResume: 718, AverageResume: 717 

Event[8082]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:54:59.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 85132, SuspendEnd: 85132 

Event[8083]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:54:59.6700000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 5 to 6.

Reason SxTransition 

BootId: 52 

Event[8084]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:55:00.4060000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 6 to 8.

Reason Unknown 

BootId: 52 

Event[8085]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T14:55:00.6960000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T10:54:53.532055100Z
Wake Time: ?2025?-?10?-?15T10:54:59.666594800Z

Wake Source: Power Button 

Event[8086]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T14:55:52.2220000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[8087]
  Log Name: System
  Source: Microsoft-Windows-UserModePowerService
  Date: 2025-10-15T14:56:54.4470000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Process C:\Windows\System32\rundll32.exe (process ID:1352) reset policy scheme from {381b4222-f694-41f0-9685-ff5bb260df2e} to {381b4222-f694-41f0-9685-ff5bb260df2e} 

Event[8088]
  Log Name: System
  Source: Microsoft-Windows-UserModePowerService
  Date: 2025-10-15T14:58:00.3720000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Process C:\Windows\explorer.exe (process ID:8768) reset policy scheme from {381b4222-f694-41f0-9685-ff5bb260df2e} to {381b4222-f694-41f0-9685-ff5bb260df2e} 

Event[8089]
  Log Name: System
  Source: Microsoft-Windows-UserModePowerService
  Date: 2025-10-15T14:58:16.5640000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Process C:\Windows\explorer.exe (process ID:8768) reset policy scheme from {381b4222-f694-41f0-9685-ff5bb260df2e} to {381b4222-f694-41f0-9685-ff5bb260df2e} 

Event[8090]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T14:58:37.0430000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[8091]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T14:58:37.0430000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[8092]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:59:23.7250000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 8 to 9.

Reason SessionUnlock 

BootId: 52 

Event[8093]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T14:59:38.5900000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 9 to 11.

Reason InputHid 

BootId: 52 

Event[8094]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:00:38.8020000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 11 to 12.

Reason SessionUnlock 

BootId: 52 

Event[8095]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:01:17.4190000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 12 to 14.

Reason InputAccelerometer 

BootId: 52 

Event[8096]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:16:53.3090000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\WINDOWS\pss\boot.backup was cleared updating 0 keys and creating 0 modified pages. 

Event[8097]
  Log Name: System
  Source: User32
  Date: 2025-10-15T15:16:58.4460000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\WINDOWS\system32\msconfig.exe (256GB-SSD) has initiated the restart of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: No title for this reason could be found
 Reason Code: 0x40000
 Shutdown Type: restart
 Comment:  

Event[8098]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-15T15:16:59.2300000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[8099]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:17:00.6970000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[8100]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:17:00.6890000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[8101]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:17:00.6900000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[8102]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T15:17:00.6910000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[8103]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T15:17:00.6910000Z
  Event ID: 51057
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service stop is almost done.DHCP Context Ref count is 1 

Event[8104]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:17:00.6920000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[8105]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:17:00.6920000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[8106]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:17:15.3290000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[8107]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:17:15.3300000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[8108]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:17:15.3320000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 4 seconds. 

Event[8109]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:17:01.3820000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[8110]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:17:01.3970000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[8111]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:17:01.4190000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Reboot 
Event Code: 0x0 
Reason: Kernel API 

Event[8112]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:17:03.8050000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[8113]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:17:04.0450000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?15T11:17:04.045572700Z. 

Event[8114]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:17:10.9090000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?15T11:17:10.500000000Z. 

Event[8115]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:17:10.9090000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?15T11:17:10.500000000Z. 

Loader time: ?2025?-?10?-?15T11:17:10.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[8116]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:17:10.9100000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[8117]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:17:10.9100000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[8118]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:17:10.9100000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[8119]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:17:10.9100000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[8120]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:17:10.9100000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[8121]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:17:10.9100000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?15T15:17:10.000000000Z. 

Event[8122]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:17:10.9100000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[8123]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:17:10.9100000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[8124]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:17:10.9140000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[8125]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:17:10.9150000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[8126]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-15T15:17:10.9310000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[8127]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-15T15:17:11.0980000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[8128]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:17:11.6230000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T05:29:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8129]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:17:11.6250000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T06:58:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8130]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:17:12.2610000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[8131]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:17:12.4050000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[8132]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:17:12.4050000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[8133]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:17:12.4060000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[8134]
  Log Name: System
  Source: Microsoft-Windows-Kernel-PnP
  Date: 2025-10-15T15:17:13.1630000Z
  Event ID: 219
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The driver \Driver\IntcAzAudAddService failed to load.
Device: HDAUDIO\FUNC_01&VEN_10EC&DEV_0235&SUBSYS_17AA3826&REV_1000\4&5fde102&0&0001
Status: 0xC000035F 

Event[8135]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:17:13.4800000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[8136]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:17:13.6820000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[8137]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:17:13.7350000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -240. 

Event[8138]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:17:14.1840000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[8139]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:17:14.1840000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[8140]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:17:14.1840000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[8141]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:17:14.1860000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[8142]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:17:14.2820000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[8143]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:17:14.2840000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[8144]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-15T15:17:14.3320000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[8145]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:17:14.4830000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[8146]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:17:14.4920000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[8147]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:17:14.4920000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[8148]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:15.8080000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-90-0-1
  User Name: Window Manager\DWM-1
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service DispBrokerDesktopSvc with arguments "Unavailable" in order to run the server:
DispBrokerDesktop.GlobalBrokerInstance 

Event[8149]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T15:17:17.3740000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
AFD
afunix
bam
cdrom
dam
Dfsc
FileCrypt
NdisCap
NetBIOS
NetBT
npsvctrig
nsiproxy
Psched
rdbss
tdx
UCPD
Vid
vwififlt
WdFilter 

Event[8150]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:20.9400000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service netprofm with arguments "Unavailable" in order to run the server:
{A47979D2-C419-11D9-A5B4-001185AD2B89} 

Event[8151]
  Log Name: System
  Source: TPM
  Date: 2025-10-15T15:17:21.2280000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[8152]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-15T15:17:24.5470000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[8153]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:25.1060000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC} 

Event[8154]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:25.4290000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.TokenBrokerInternal 

Event[8155]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:25.4820000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC} 

Event[8156]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:25.7030000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service WpnUserService_35c7e with arguments "Unavailable" in order to run the server:
{1FFE4FFD-25B1-40B1-A1EA-EF633353BB4E} 

Event[8157]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:26.2330000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdkInternal.System.ActivationService 

Event[8158]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:26.2370000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.TokenBrokerInternal 

Event[8159]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:26.3770000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdk.UI.Shell.ViewCoordinator 

Event[8160]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:26.5210000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.TokenBrokerInternal 

Event[8161]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:26.5310000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service camsvc with arguments "Unavailable" in order to run the server:
Windows.Internal.CapabilityAccess.CapabilityAccess 

Event[8162]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:26.6220000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.TokenBrokerInternal 

Event[8163]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:26.6240000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service camsvc with arguments "Unavailable" in order to run the server:
Windows.Internal.CapabilityAccess.CapabilityAccess 

Event[8164]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:26.7950000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdkInternal.System.ActivationService 

Event[8165]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:26.8920000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service camsvc with arguments "Unavailable" in order to run the server:
Windows.Internal.CapabilityAccess.CapabilityAccess 

Event[8166]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:26.8940000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service camsvc with arguments "Unavailable" in order to run the server:
Windows.Internal.CapabilityAccess.CapabilityAccess 

Event[8167]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:26.9060000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.TokenBrokerInternal 

Event[8168]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:26.9430000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.TokenBrokerInternal 

Event[8169]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:26.9570000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service WpnUserService_35c7e with arguments "Unavailable" in order to run the server:
{1FFE4FFD-25B1-40B1-A1EA-EF633353BB4E} 

Event[8170]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:26.9610000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service WpnUserService_35c7e with arguments "Unavailable" in order to run the server:
{D18705BE-FC2F-44C8-AEFF-1CD49AEA8FC1} 

Event[8171]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:26.9630000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.TokenBrokerInternal 

Event[8172]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:26.9630000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.TokenBrokerInternal 

Event[8173]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:27.0420000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service EventSystem with arguments "Unavailable" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF} 

Event[8174]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:27.1090000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.TokenBrokerInternal 

Event[8175]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:27.1130000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service camsvc with arguments "Unavailable" in order to run the server:
Windows.Internal.CapabilityAccess.CapabilityAccess 

Event[8176]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:27.2450000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service camsvc with arguments "Unavailable" in order to run the server:
Windows.Internal.CapabilityAccess.CapabilityAccess 

Event[8177]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:27.2470000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service camsvc with arguments "Unavailable" in order to run the server:
Windows.Internal.CapabilityAccess.Management.CapabilityUsage 

Event[8178]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:27.2490000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service camsvc with arguments "Unavailable" in order to run the server:
Windows.Internal.CapabilityAccess.CapabilityAccess 

Event[8179]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:27.2630000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service netprofm with arguments "Unavailable" in order to run the server:
{A47979D2-C419-11D9-A5B4-001185AD2B89} 

Event[8180]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:27.2690000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service netprofm with arguments "Unavailable" in order to run the server:
{A47979D2-C419-11D9-A5B4-001185AD2B89} 

Event[8181]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:27.3140000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service WpnUserService_35c7e with arguments "Unavailable" in order to run the server:
{F53321FA-34F8-4B7F-B9A3-361877CB94CF} 

Event[8182]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:28.4140000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service netprofm with arguments "Unavailable" in order to run the server:
{A47979D2-C419-11D9-A5B4-001185AD2B89} 

Event[8183]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:28.4160000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service netprofm with arguments "Unavailable" in order to run the server:
{A47979D2-C419-11D9-A5B4-001185AD2B89} 

Event[8184]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:28.8790000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service netprofm with arguments "Unavailable" in order to run the server:
{A47979D2-C419-11D9-A5B4-001185AD2B89} 

Event[8185]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:28.9480000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.TokenBrokerInternal 

Event[8186]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:29.0370000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service netprofm with arguments "Unavailable" in order to run the server:
{A47979D2-C419-11D9-A5B4-001185AD2B89} 

Event[8187]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:29.0420000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service netprofm with arguments "Unavailable" in order to run the server:
{A47979D2-C419-11D9-A5B4-001185AD2B89} 

Event[8188]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:29.1900000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdkInternal.System.ActivationService 

Event[8189]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:29.5540000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdkInternal.System.ActivationService 

Event[8190]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:29.6820000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.TokenBrokerInternal 

Event[8191]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:29.6880000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.WamProviderRegistration 

Event[8192]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:32.9970000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.TokenBrokerInternal 

Event[8193]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:32.9970000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.WamProviderRegistration 

Event[8194]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:32.9990000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.WamProviderRegistration 

Event[8195]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:32.9990000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service netprofm with arguments "Unavailable" in order to run the server:
{A47979D2-C419-11D9-A5B4-001185AD2B89} 

Event[8196]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:32.9990000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.WamProviderRegistration 

Event[8197]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:33.0010000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.WamProviderRegistration 

Event[8198]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:33.0010000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.TokenBrokerInternal 

Event[8199]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:33.0030000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.WamProviderRegistration 

Event[8200]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:33.0030000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.WamProviderRegistration 

Event[8201]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:33.3400000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.TokenBrokerInternal 

Event[8202]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:33.8050000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC} 

Event[8203]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:39.3550000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdk.UI.Shell.ViewCoordinator 

Event[8204]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:39.3710000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdk.UI.Shell.ViewCoordinator 

Event[8205]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:39.3790000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdk.UI.Shell.ViewCoordinator 

Event[8206]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:39.3890000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdkInternal.System.ActivationService 

Event[8207]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:39.4010000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdk.UI.Shell.ViewCoordinator 

Event[8208]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:39.6670000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service camsvc with arguments "Unavailable" in order to run the server:
Windows.Internal.CapabilityAccess.CapabilityAccess 

Event[8209]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:51.1160000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdk.UI.Shell.ViewCoordinator 

Event[8210]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:51.1210000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdk.UI.Shell.ViewCoordinator 

Event[8211]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:51.1270000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdk.UI.Shell.ViewCoordinator 

Event[8212]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:51.1390000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdkInternal.System.ActivationService 

Event[8213]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:17:51.1430000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdk.UI.Shell.ViewCoordinator 

Event[8214]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:18:00.7550000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdk.UI.Shell.ViewCoordinator 

Event[8215]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:18:00.7610000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdk.UI.Shell.ViewCoordinator 

Event[8216]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:18:00.7670000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdk.UI.Shell.ViewCoordinator 

Event[8217]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:18:00.7770000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdkInternal.System.ActivationService 

Event[8218]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:18:00.7850000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdk.UI.Shell.ViewCoordinator 

Event[8219]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:18:47.8610000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC} 

Event[8220]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:18:51.9540000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdk.UI.Shell.ViewCoordinator 

Event[8221]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:18:51.9620000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdk.UI.Shell.ViewCoordinator 

Event[8222]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:18:51.9680000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdk.UI.Shell.ViewCoordinator 

Event[8223]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:18:51.9800000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdkInternal.System.ActivationService 

Event[8224]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:18:51.9860000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdk.UI.Shell.ViewCoordinator 

Event[8225]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:18:57.8800000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdk.UI.Shell.ViewCoordinator 

Event[8226]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:18:57.8810000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdkInternal.System.ActivationService 

Event[8227]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:18:57.9790000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.TokenBrokerInternal 

Event[8228]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:18:57.9850000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.WamProviderRegistration 

Event[8229]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:18:58.0730000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdk.UI.Shell.ViewCoordinator 

Event[8230]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:18:58.2680000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service camsvc with arguments "Unavailable" in order to run the server:
Windows.Internal.CapabilityAccess.CapabilityAccess 

Event[8231]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:18:59.2110000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdkInternal.System.ActivationService 

Event[8232]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:18:59.4370000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdkInternal.System.ActivationService 

Event[8233]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:18:59.6000000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdkInternal.System.ActivationService 

Event[8234]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:18:59.7510000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdkInternal.System.ActivationService 

Event[8235]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:19:02.1760000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service UdkUserSvc_35c7e with arguments "Unavailable" in order to run the server:
WindowsUdk.UI.Shell.ViewCoordinator 

Event[8236]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:19:02.6010000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC} 

Event[8237]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:19:05.1740000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.WamProviderRegistration 

Event[8238]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:19:05.1760000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.TokenBrokerInternal 

Event[8239]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:19:05.1760000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service TokenBroker with arguments "Unavailable" in order to run the server:
Windows.Internal.Security.Authentication.Web.WamProviderRegistration 

Event[8240]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:19:18.0390000Z
  Event ID: 10005
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server:
{DD522ACC-F821-461A-A407-50B198B896DC} 

Event[8241]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:19:20.1230000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[8242]
  Log Name: System
  Source: User32
  Date: 2025-10-15T15:19:19.4280000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\WINDOWS\system32\msconfig.exe (256GB-SSD) has initiated the restart of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: No title for this reason could be found
 Reason Code: 0x40000
 Shutdown Type: restart
 Comment:  

Event[8243]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-15T15:19:20.0880000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[8244]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:19:35.5030000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[8245]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:19:35.5030000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[8246]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:19:35.5040000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[8247]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:19:20.5850000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Reboot 
Event Code: 0x0 
Reason: Kernel API 

Event[8248]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:19:23.0710000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[8249]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:19:23.2420000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?15T11:19:23.242259500Z. 

Event[8250]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:19:30.8950000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?15T11:19:30.500000000Z. 

Event[8251]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:19:30.8950000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?15T11:19:30.500000000Z. 

Loader time: ?2025?-?10?-?15T11:19:29.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[8252]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:19:30.8960000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[8253]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:19:30.8960000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[8254]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:19:30.8960000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[8255]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:19:30.8960000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[8256]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:19:30.8960000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[8257]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:19:30.8960000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?15T15:19:29.000000000Z. 

Event[8258]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:19:30.8960000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[8259]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:19:30.8960000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[8260]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:19:30.9000000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[8261]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:19:30.9000000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[8262]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-15T15:19:30.9300000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[8263]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-15T15:19:31.0930000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[8264]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:19:31.3040000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T05:29:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8265]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:19:31.3050000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T06:58:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8266]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:19:31.3060000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T13:57:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8267]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:19:31.6710000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[8268]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:19:31.7540000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T02:07:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8269]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:19:31.7590000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T02:42:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8270]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:19:31.8660000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T13:13:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8271]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:19:31.8990000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[8272]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:19:31.8990000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[8273]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:19:31.9010000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[8274]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-15T15:19:32.4230000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[8275]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:19:32.4630000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8276]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:19:32.4720000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8277]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:19:32.4730000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8278]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:19:32.4740000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8279]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:19:32.4760000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8280]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:19:32.4770000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8281]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:19:32.4780000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8282]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-15T15:19:32.5070000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[8283]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:19:32.5090000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8284]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:19:32.5130000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[8285]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:19:32.5840000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[8286]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:19:33.0510000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[8287]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:19:33.2520000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[8288]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:19:33.3150000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -240. 

Event[8289]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:19:34.0750000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[8290]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:19:34.0750000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[8291]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:19:34.0750000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[8292]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:19:34.0760000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[8293]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:19:34.1690000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[8294]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:19:34.1710000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[8295]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-15T15:19:34.2230000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[8296]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:19:34.4010000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[8297]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:19:34.4140000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[8298]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:19:34.4140000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[8299]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:19:35.3540000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T18:58:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8300]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:19:35.3640000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T06:02:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8301]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:19:35.3700000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T17:49:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8302]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:19:35.3820000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T15:27:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8303]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:19:35.3990000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8304]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:19:35.3990000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T01:25:34.000000000Z) unloaded successfully. 

Event[8305]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:19:35.3990000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8306]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:19:35.4040000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T15:01:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8307]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:19:35.4160000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T14:47:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8308]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:19:35.4230000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T07:53:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8309]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:19:35.7600000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[8310]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:19:35.7600000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[8311]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:19:35.7610000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[8312]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T15:19:35.7890000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[8313]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:19:35.9700000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8314]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:19:35.9700000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8315]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:19:35.9700000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8316]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:19:35.9700000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8317]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:19:35.9700000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8318]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:19:35.9700000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8319]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:19:35.9700000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8320]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:19:35.9700000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8321]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:19:35.9700000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8322]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:19:35.9700000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8323]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:19:35.9700000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8324]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:19:35.9700000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8325]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:19:35.9700000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8326]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:19:35.9700000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8327]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:19:37.6200000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[8328]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:19:37.6200000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000054-0000000000.json for detailed information on what checks were made. 

Event[8329]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T15:19:37.6640000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[8330]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:19:37.8050000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[8331]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:19:37.8420000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[8332]
  Log Name: System
  Source: TPM
  Date: 2025-10-15T15:19:41.2250000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[8333]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:19:41.9880000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[8334]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:19:42.4720000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[8335]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-15T15:19:42.9210000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[8336]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:20:30.1820000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[8337]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:20:30.1840000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[8338]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:20:30.1840000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[8339]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:20:30.1840000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[8340]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:20:43.6220000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[8341]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:20:43.6370000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[8342]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:20:43.6370000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[8343]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:20:43.6370000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[8344]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:20:43.6370000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[8345]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:20:43.6370000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[8346]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:20:43.6370000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[8347]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:20:43.6530000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[8348]
  Log Name: System
  Source: User32
  Date: 2025-10-15T15:20:54.1030000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\ImmersiveControlPanel\SystemSettings.exe (256GB-SSD) has initiated the restart of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: restart
 Comment:  

Event[8349]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-15T15:20:54.9710000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[8350]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:20:56.2830000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[8351]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:20:56.2700000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[8352]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:20:56.2700000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[8353]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T15:20:56.2730000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[8354]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:20:56.2740000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[8355]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T15:20:56.3800000Z
  Event ID: 51057
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service stop is almost done.DHCP Context Ref count is 1 

Event[8356]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:23:39.0920000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[8357]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:23:39.0920000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[8358]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:23:39.0930000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 4 seconds. 

Event[8359]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:20:56.3810000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[8360]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:20:56.9930000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[8361]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:20:57.0100000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[8362]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:20:57.2910000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Reboot 
Event Code: 0x0 
Reason: Kernel API 

Event[8363]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:20:57.6200000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[8364]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:20:57.8560000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?15T11:20:57.856642900Z. 

Event[8365]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:23:34.9110000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?15T11:23:34.500000000Z. 

Event[8366]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:23:34.9110000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?15T11:23:34.500000000Z. 

Loader time: ?2025?-?10?-?15T11:23:34.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[8367]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:23:34.9110000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[8368]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:23:34.9110000Z
  Event ID: 26
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
A one-time boot sequence was used during this boot. 

Event[8369]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:23:34.9110000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[8370]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:23:34.9110000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[8371]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:23:34.9110000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[8372]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:23:34.9120000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?15T15:23:34.000000000Z. 

Event[8373]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:23:34.9120000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[8374]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:23:34.9120000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[8375]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:23:34.9150000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[8376]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:23:34.9160000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[8377]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-15T15:23:34.9640000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[8378]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-15T15:23:35.1270000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[8379]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:23:35.3530000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T05:29:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8380]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:23:35.3540000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T06:58:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8381]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:23:35.3550000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T13:57:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8382]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:23:35.7170000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[8383]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:23:35.8030000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T02:07:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8384]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:23:35.8080000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T02:42:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8385]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:23:35.9160000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T13:13:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8386]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:23:35.9490000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[8387]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:23:35.9490000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[8388]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:23:35.9510000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[8389]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-15T15:23:36.4740000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[8390]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-15T15:23:36.5590000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[8391]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:23:36.5660000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8392]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:23:36.5750000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8393]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:23:36.5790000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8394]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:23:36.5810000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8395]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:23:36.5820000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8396]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:23:36.5830000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8397]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:23:36.5840000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8398]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:23:36.7410000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8399]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:23:36.7620000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[8400]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:23:36.8250000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[8401]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:23:37.1140000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[8402]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:23:37.2690000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[8403]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:23:37.3380000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -240. 

Event[8404]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:23:38.0630000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[8405]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:23:38.0640000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[8406]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:23:38.0640000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[8407]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:23:38.0650000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[8408]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:23:38.2000000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[8409]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:23:38.2010000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[8410]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-15T15:23:38.2640000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[8411]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:23:38.4780000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[8412]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:23:38.4900000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[8413]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:23:38.4900000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[8414]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:23:38.9510000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T18:58:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8415]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:23:38.9610000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T06:02:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8416]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:23:38.9670000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T17:49:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8417]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:23:38.9800000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T15:27:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8418]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:23:38.9980000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8419]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:23:38.9980000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T01:25:34.000000000Z) unloaded successfully. 

Event[8420]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:23:38.9980000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8421]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:23:39.0040000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T15:01:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8422]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:23:39.0100000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T14:47:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8423]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:23:39.0170000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T07:53:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8424]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:23:39.3170000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[8425]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:23:39.3170000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[8426]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:23:39.3170000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[8427]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T15:23:39.3480000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[8428]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:23:39.5670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8429]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:23:39.5670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8430]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:23:39.5670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8431]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:23:39.5670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8432]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:23:39.5670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8433]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:23:39.5670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8434]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:23:39.5670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8435]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:23:39.5670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8436]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:23:39.5670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8437]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:23:39.5670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8438]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:23:39.5670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8439]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:23:39.5670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8440]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:23:39.5670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8441]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:23:39.5670000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8442]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-15T15:23:39.5840000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[8443]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:23:40.9370000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[8444]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:23:40.9370000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000055-0000000000.json for detailed information on what checks were made. 

Event[8445]
  Log Name: System
  Source: Microsoft-Windows-StartupRepair
  Date: 2025-10-15T15:23:41.2300000Z
  Event ID: 1002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Startup Repair failed. 

Event[8446]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T15:23:41.3550000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[8447]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:23:41.5070000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[8448]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:23:41.5360000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[8449]
  Log Name: System
  Source: TPM
  Date: 2025-10-15T15:23:45.2620000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[8450]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:23:48.7250000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[8451]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:23:49.4760000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[8452]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:24:47.7220000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[8453]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:24:47.7390000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[8454]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:24:47.7390000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[8455]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:24:47.7390000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[8456]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:24:47.7390000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[8457]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:24:47.7390000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[8458]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:24:47.7540000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[8459]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:24:47.7700000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[8460]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:24:54.8230000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 0 to 1.

Reason SessionUnlock 

BootId: 55 

Event[8461]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:25:25.0430000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 1 to 3.

Reason InputHid 

BootId: 55 

Event[8462]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:25:47.8110000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[8463]
  Log Name: System
  Source: User32
  Date: 2025-10-15T15:26:08.5410000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\Windows\System32\RuntimeBroker.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: Other (Unplanned)
 Reason Code: 0x0
 Shutdown Type: power off
 Comment:  

Event[8464]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-15T15:26:09.2660000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[8465]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:26:09.7710000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[8466]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:26:09.7570000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[8467]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:26:09.7580000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[8468]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:26:09.7630000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[8469]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T15:26:09.7710000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[8470]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T15:26:09.7710000Z
  Event ID: 51057
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service stop is almost done.DHCP Context Ref count is 1 

Event[8471]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:26:09.7810000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[8472]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:26:41.9260000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[8473]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:26:41.9270000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[8474]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:26:41.9280000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[8475]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:26:10.5000000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[8476]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:26:10.5550000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[8477]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:26:10.5720000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[8478]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:26:12.4310000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[8479]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:26:12.6380000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?15T11:26:12.638246700Z. 

Event[8480]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:26:36.9110000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?15T11:26:36.500000000Z. 

Event[8481]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:26:36.9110000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?15T11:26:36.500000000Z. 

Loader time: ?2025?-?10?-?15T11:26:36.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[8482]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:26:36.9120000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[8483]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:26:36.9120000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[8484]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:26:36.9120000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[8485]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:26:36.9120000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[8486]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:26:36.9120000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[8487]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:26:36.9120000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?15T15:26:36.000000000Z. 

Event[8488]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:26:36.9120000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[8489]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:26:36.9120000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[8490]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:26:36.9160000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[8491]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:26:36.9160000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[8492]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-15T15:26:36.9640000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[8493]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-15T15:26:37.1270000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[8494]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:26:37.3730000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T05:29:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8495]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:26:37.3740000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T06:58:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8496]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:26:37.3750000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T13:57:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8497]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:26:38.0990000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[8498]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:26:38.1820000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T02:07:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8499]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:26:38.1870000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T02:42:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8500]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:26:38.2940000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T13:13:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8501]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:26:38.3280000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[8502]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:26:38.3280000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[8503]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:26:38.3290000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[8504]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-15T15:26:38.8600000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[8505]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-15T15:26:38.9430000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[8506]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:26:38.9490000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8507]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:26:38.9610000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8508]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:26:38.9620000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8509]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:26:38.9630000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8510]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:26:38.9650000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8511]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:26:38.9660000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8512]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:26:38.9670000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8513]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:26:38.9980000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8514]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:26:39.0020000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[8515]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:26:39.0660000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[8516]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:26:39.4770000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[8517]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:26:39.6780000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[8518]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:26:39.7420000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -240. 

Event[8519]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:26:40.5020000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[8520]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:26:40.5030000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[8521]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:26:40.5030000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[8522]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:26:40.5040000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[8523]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:26:40.6000000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[8524]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:26:40.6010000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[8525]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-15T15:26:40.6510000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[8526]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:26:40.8260000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[8527]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:26:40.8380000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[8528]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:26:40.8380000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[8529]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:26:41.7820000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T18:58:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8530]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:26:41.7920000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T06:02:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8531]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:26:41.7980000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T17:49:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8532]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:26:41.8110000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T15:27:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8533]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:26:41.8330000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8534]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:26:41.8330000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T01:25:34.000000000Z) unloaded successfully. 

Event[8535]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:26:41.8330000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8536]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:26:41.8380000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T15:01:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8537]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:26:41.8440000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T14:47:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8538]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:26:41.8510000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T07:53:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8539]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:26:42.1780000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[8540]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:26:42.1780000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[8541]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:26:42.1790000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[8542]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T15:26:42.2360000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[8543]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:26:42.4470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8544]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:26:42.4470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8545]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:26:42.4470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8546]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:26:42.4470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8547]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:26:42.4470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8548]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:26:42.4470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8549]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:26:42.4470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8550]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:26:42.4470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8551]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:26:42.4470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8552]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:26:42.4470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8553]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:26:42.4470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8554]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:26:42.4470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8555]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:26:42.4470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8556]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:26:42.4470000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8557]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-15T15:26:42.4570000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[8558]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:26:43.6480000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[8559]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:26:43.6480000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000056-0000000000.json for detailed information on what checks were made. 

Event[8560]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T15:26:44.1550000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[8561]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:26:44.2770000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[8562]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:26:44.3140000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[8563]
  Log Name: System
  Source: TPM
  Date: 2025-10-15T15:26:47.2550000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[8564]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:26:48.3550000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[8565]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:26:49.6260000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[8566]
  Log Name: System
  Source: User32
  Date: 2025-10-15T15:27:16.1060000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\WINDOWS\system32\winlogon.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: No title for this reason could be found
 Reason Code: 0x500ff
 Shutdown Type: power off
 Comment:  

Event[8567]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:27:21.1800000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[8568]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-15T15:27:20.9260000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[8569]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:27:21.1720000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[8570]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:27:21.1730000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[8571]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T15:27:21.1730000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[8572]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:27:21.1750000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[8573]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T15:27:21.2840000Z
  Event ID: 51057
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service stop is almost done.DHCP Context Ref count is 1 

Event[8574]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:27:42.0950000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[8575]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:27:42.0950000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[8576]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:27:42.0960000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[8577]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:27:21.2840000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[8578]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:27:21.8940000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[8579]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:27:21.9090000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[8580]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:27:21.9280000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[8581]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:27:22.5870000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[8582]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:27:22.8360000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?15T11:27:22.836629900Z. 

Event[8583]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:27:36.9100000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?15T11:27:36.500000000Z. 

Event[8584]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:27:36.9100000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?15T11:27:36.500000000Z. 

Loader time: ?2025?-?10?-?15T11:27:36.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[8585]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:27:36.9110000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[8586]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:27:36.9110000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[8587]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:27:36.9110000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[8588]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:27:36.9110000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[8589]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:27:36.9110000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[8590]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:27:36.9110000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?15T15:27:36.000000000Z. 

Event[8591]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:27:36.9110000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[8592]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:27:36.9110000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[8593]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:27:36.9150000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[8594]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:27:36.9150000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[8595]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-15T15:27:36.9540000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[8596]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-15T15:27:37.1160000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[8597]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:27:37.3180000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T05:29:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8598]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:27:37.3190000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T06:58:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8599]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:27:37.3200000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T13:57:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8600]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:27:37.7210000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[8601]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:27:37.8350000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T02:07:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8602]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:27:37.8400000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T02:42:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8603]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:27:38.0010000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T13:13:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8604]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:27:38.0520000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[8605]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:27:38.0520000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[8606]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:27:38.0540000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[8607]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-15T15:27:38.8120000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[8608]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:27:38.8550000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8609]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:27:38.8880000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8610]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:27:38.8890000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8611]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:27:38.8900000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8612]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:27:38.8910000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8613]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:27:38.8920000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8614]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:27:38.8940000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8615]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-15T15:27:38.8970000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[8616]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:27:38.8990000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8617]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:27:38.9030000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[8618]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:27:38.9820000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[8619]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:27:39.5350000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[8620]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:27:39.7370000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[8621]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:27:39.8340000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -240. 

Event[8622]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:27:40.6680000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[8623]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:27:40.6680000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[8624]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:27:40.6680000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[8625]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:27:40.6690000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[8626]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:27:40.7690000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[8627]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:27:40.7710000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[8628]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-15T15:27:40.8210000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[8629]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:27:40.9910000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[8630]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:27:41.0020000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[8631]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:27:41.0020000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[8632]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:27:41.9490000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T18:58:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8633]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:27:41.9590000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T06:02:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8634]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:27:41.9640000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T17:49:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8635]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:27:41.9780000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T15:27:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8636]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:27:41.9960000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8637]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:27:41.9960000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T01:25:34.000000000Z) unloaded successfully. 

Event[8638]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:27:41.9970000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8639]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:27:42.0020000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T15:01:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8640]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:27:42.0080000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T14:47:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8641]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:27:42.0150000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T07:53:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8642]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:27:42.3130000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[8643]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:27:42.3130000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[8644]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:27:42.3130000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[8645]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T15:27:42.3480000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[8646]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:27:42.5560000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8647]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:27:42.5560000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8648]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:27:42.5560000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8649]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:27:42.5560000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8650]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:27:42.5560000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8651]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:27:42.5560000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8652]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:27:42.5560000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8653]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:27:42.5560000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8654]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:27:42.5560000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8655]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:27:42.5560000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8656]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:27:42.5560000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8657]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:27:42.5560000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8658]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:27:42.5560000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8659]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:27:42.5560000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8660]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-15T15:27:42.5760000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[8661]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:27:43.8310000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[8662]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:27:43.8310000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000057-0000000000.json for detailed information on what checks were made. 

Event[8663]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T15:27:44.2850000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[8664]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:27:44.4240000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[8665]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:27:44.4610000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[8666]
  Log Name: System
  Source: TPM
  Date: 2025-10-15T15:27:47.2560000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[8667]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:27:48.8430000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[8668]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:27:50.5200000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[8669]
  Log Name: System
  Source: User32
  Date: 2025-10-15T15:27:51.7820000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\WINDOWS\system32\winlogon.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: No title for this reason could be found
 Reason Code: 0x500ff
 Shutdown Type: power off
 Comment:  

Event[8670]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:27:53.2320000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[8671]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-15T15:27:52.9620000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[8672]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:27:53.2160000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[8673]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:27:53.2170000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[8674]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:27:53.2180000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[8675]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T15:27:53.2190000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[8676]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T15:27:53.3270000Z
  Event ID: 51057
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service stop is almost done.DHCP Context Ref count is 1 

Event[8677]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:28:14.0960000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[8678]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:28:14.0960000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[8679]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:28:14.0970000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[8680]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:27:53.3270000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[8681]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:27:53.9370000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[8682]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:27:53.9590000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[8683]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:27:54.5490000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[8684]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:27:54.8790000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[8685]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:27:55.1250000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?15T11:27:55.125896700Z. 

Event[8686]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:28:08.9090000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?15T11:28:08.500000000Z. 

Event[8687]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:28:08.9090000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?15T11:28:08.500000000Z. 

Loader time: ?2025?-?10?-?15T11:28:08.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[8688]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:28:08.9090000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[8689]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:28:08.9100000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[8690]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:28:08.9100000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[8691]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:28:08.9100000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[8692]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:28:08.9100000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[8693]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:28:08.9100000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?15T15:28:08.000000000Z. 

Event[8694]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:28:08.9100000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[8695]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:28:08.9100000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[8696]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:28:08.9140000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[8697]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:28:08.9140000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[8698]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-15T15:28:08.9410000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[8699]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-15T15:28:09.1040000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[8700]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:09.3190000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T05:29:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8701]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:09.3210000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T06:58:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8702]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:09.3220000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T13:57:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8703]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:28:09.7140000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[8704]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:09.8260000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T02:07:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8705]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:09.8310000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T02:42:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8706]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:09.9900000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T13:13:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8707]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:28:10.0410000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[8708]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:28:10.0410000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[8709]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:28:10.0440000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[8710]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-15T15:28:10.7830000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[8711]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:28:10.8250000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8712]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:28:10.8330000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8713]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:28:10.8340000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8714]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:28:10.8360000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8715]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:28:10.8590000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8716]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:28:10.8600000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8717]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:28:10.8610000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8718]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-15T15:28:10.8650000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[8719]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:28:10.8800000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8720]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:28:10.8930000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[8721]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:28:10.9760000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[8722]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:28:11.5450000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[8723]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:28:11.7710000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[8724]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:28:11.8420000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -240. 

Event[8725]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:28:12.6750000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[8726]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:28:12.6750000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[8727]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:28:12.6750000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[8728]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:28:12.6760000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[8729]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:28:12.7740000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[8730]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:28:12.7760000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[8731]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-15T15:28:12.8280000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[8732]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:28:13.0020000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[8733]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:28:13.0150000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[8734]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:28:13.0150000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[8735]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:13.9520000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T18:58:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8736]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:13.9590000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T06:02:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8737]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:13.9640000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T17:49:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8738]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:13.9710000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T15:27:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8739]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:13.9890000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8740]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:13.9890000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T01:25:34.000000000Z) unloaded successfully. 

Event[8741]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:13.9890000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8742]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:13.9930000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T15:01:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8743]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:14.0050000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T14:47:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8744]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:14.0120000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T07:53:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8745]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:28:14.3300000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[8746]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:28:14.3300000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[8747]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:28:14.3300000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[8748]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T15:28:14.3530000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[8749]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:14.5690000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8750]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:14.5690000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8751]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:14.5690000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8752]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:14.5690000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8753]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:14.5690000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8754]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:14.5700000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8755]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:14.5700000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8756]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:14.5700000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8757]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:14.5700000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8758]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:14.5700000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8759]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:14.5700000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8760]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:14.5700000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8761]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:14.5700000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8762]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:14.5700000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8763]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-15T15:28:14.6200000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[8764]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T15:28:15.6460000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[8765]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:28:15.7300000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[8766]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:28:15.7300000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000058-0000000000.json for detailed information on what checks were made. 

Event[8767]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:28:15.7620000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[8768]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:28:15.7930000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[8769]
  Log Name: System
  Source: TPM
  Date: 2025-10-15T15:28:19.2340000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[8770]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:28:22.1320000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[8771]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:28:22.8870000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[8772]
  Log Name: System
  Source: User32
  Date: 2025-10-15T15:28:23.6270000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\WINDOWS\system32\winlogon.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: No title for this reason could be found
 Reason Code: 0x500ff
 Shutdown Type: power off
 Comment:  

Event[8773]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:28:24.7570000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[8774]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-15T15:28:24.4850000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[8775]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:28:24.7490000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[8776]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:28:24.7510000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[8777]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:28:24.7530000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[8778]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T15:28:24.7560000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[8779]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T15:28:24.8650000Z
  Event ID: 51057
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service stop is almost done.DHCP Context Ref count is 1 

Event[8780]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:28:45.5460000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[8781]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:28:45.5470000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[8782]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:28:45.5470000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[8783]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:28:24.8650000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[8784]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:28:25.4430000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[8785]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:28:25.4710000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[8786]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:28:26.0120000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[8787]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:28:26.4550000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[8788]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:28:26.7370000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?15T11:28:26.737343800Z. 

Event[8789]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:28:40.9020000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?15T11:28:40.500000000Z. 

Event[8790]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:28:40.9020000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?15T11:28:40.500000000Z. 

Loader time: ?2025?-?10?-?15T11:28:39.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[8791]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:28:40.9020000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[8792]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:28:40.9030000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[8793]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:28:40.9030000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[8794]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:28:40.9030000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[8795]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:28:40.9030000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[8796]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:28:40.9030000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?15T15:28:39.000000000Z. 

Event[8797]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:28:40.9030000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[8798]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:28:40.9030000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[8799]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:28:40.9070000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[8800]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:28:40.9070000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[8801]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-15T15:28:40.9540000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[8802]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-15T15:28:41.1200000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[8803]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:41.3310000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T05:29:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8804]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:41.3320000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T06:58:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8805]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:41.3330000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T13:57:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8806]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:28:41.7300000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[8807]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:41.8420000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T02:07:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8808]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:41.8470000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T02:42:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8809]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:42.0040000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T13:13:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8810]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:28:42.0530000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[8811]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:28:42.0530000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[8812]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:28:42.0560000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[8813]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-15T15:28:42.7940000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[8814]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:28:42.8360000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8815]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:28:42.8450000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8816]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:28:42.8580000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8817]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:28:42.8690000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8818]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:28:42.8710000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8819]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:28:42.8720000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8820]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:28:42.8730000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8821]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-15T15:28:42.8750000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[8822]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:28:42.8940000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8823]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:28:42.9030000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[8824]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:28:42.9700000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[8825]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:28:43.5000000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[8826]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:28:43.7240000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[8827]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:28:43.8190000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -240. 

Event[8828]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:28:44.6320000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[8829]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:28:44.6320000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[8830]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:28:44.6320000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[8831]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:28:44.6330000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[8832]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:28:44.7250000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[8833]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:28:44.7270000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[8834]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-15T15:28:44.7830000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[8835]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:28:44.9520000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[8836]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:28:44.9620000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[8837]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:28:44.9620000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[8838]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:45.4040000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T18:58:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8839]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:45.4150000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T06:02:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8840]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:45.4200000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T17:49:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8841]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:45.4330000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T15:27:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8842]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:45.4520000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8843]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:45.4520000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T01:25:34.000000000Z) unloaded successfully. 

Event[8844]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:45.4520000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8845]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:45.4580000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T15:01:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8846]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:45.4640000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T14:47:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8847]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:28:45.4710000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T07:53:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8848]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:28:45.8360000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[8849]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:28:45.8360000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[8850]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:28:45.8360000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[8851]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T15:28:45.8560000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[8852]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-15T15:28:46.0140000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[8853]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:46.0610000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8854]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:46.0610000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8855]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:46.0610000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8856]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:46.0610000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8857]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:46.0610000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8858]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:46.0610000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8859]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:46.0610000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8860]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:46.0610000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8861]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:46.0610000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8862]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:46.0610000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8863]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:46.0610000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8864]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:46.0610000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8865]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:46.0610000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8866]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:28:46.0610000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8867]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:28:47.3810000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[8868]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:28:47.3810000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000059-0000000000.json for detailed information on what checks were made. 

Event[8869]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T15:28:47.8190000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[8870]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:28:47.9610000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[8871]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:28:47.9970000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[8872]
  Log Name: System
  Source: TPM
  Date: 2025-10-15T15:28:51.2410000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[8873]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:28:53.0630000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[8874]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:28:53.9760000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[8875]
  Log Name: System
  Source: User32
  Date: 2025-10-15T15:28:55.2350000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\WINDOWS\system32\winlogon.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: No title for this reason could be found
 Reason Code: 0x500ff
 Shutdown Type: power off
 Comment:  

Event[8876]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-15T15:28:56.0890000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[8877]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:28:56.3560000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[8878]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:28:56.3440000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[8879]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:28:56.3460000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[8880]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:28:56.3470000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[8881]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T15:28:56.3500000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[8882]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T15:28:56.3500000Z
  Event ID: 51057
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service stop is almost done.DHCP Context Ref count is 1 

Event[8883]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:28:56.3510000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[8884]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:29:16.5900000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[8885]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:29:16.5910000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[8886]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:29:16.5920000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 5 seconds. 

Event[8887]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:28:57.0460000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[8888]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:28:57.0750000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[8889]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:28:57.8670000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[8890]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:28:58.2790000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[8891]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:28:58.5110000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?15T11:28:58.511830700Z. 

Event[8892]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:29:11.9160000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?15T11:29:11.500000000Z. 

Event[8893]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:29:11.9160000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?15T11:29:11.500000000Z. 

Loader time: ?2025?-?10?-?15T11:29:10.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[8894]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:29:11.9160000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[8895]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:29:11.9170000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[8896]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:29:11.9170000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[8897]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:29:11.9170000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[8898]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:29:11.9170000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[8899]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:29:11.9170000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?15T15:29:10.000000000Z. 

Event[8900]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:29:11.9170000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[8901]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:29:11.9170000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[8902]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:29:11.9210000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[8903]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:29:11.9210000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[8904]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-15T15:29:11.9510000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[8905]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-15T15:29:12.1140000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[8906]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:29:12.3220000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T05:29:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8907]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:29:12.3230000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T06:58:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8908]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:29:12.3250000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T13:57:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8909]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:29:12.7150000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[8910]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:29:12.8250000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T02:07:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8911]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:29:12.8310000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T02:42:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8912]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:29:12.9870000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T13:13:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8913]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:29:13.0370000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[8914]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:29:13.0370000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[8915]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:29:13.0390000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[8916]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-15T15:29:13.7750000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[8917]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:29:13.8170000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8918]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:29:13.8260000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8919]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:29:13.8270000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8920]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:29:13.8480000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8921]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:29:13.8500000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8922]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:29:13.8510000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8923]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:29:13.8520000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8924]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-15T15:29:13.8570000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[8925]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:29:13.8730000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[8926]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:29:13.8770000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[8927]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:29:13.9570000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[8928]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:29:14.4850000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[8929]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:29:14.7110000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[8930]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:29:14.7790000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -240. 

Event[8931]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:29:15.6340000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[8932]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:29:15.6340000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[8933]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:29:15.6340000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[8934]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:29:15.6350000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[8935]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:29:15.7480000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[8936]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:29:15.7500000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[8937]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-15T15:29:15.8010000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[8938]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:29:15.9840000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[8939]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:29:15.9940000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[8940]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:29:15.9940000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[8941]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:29:16.4460000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T18:58:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8942]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:29:16.4560000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T06:02:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8943]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:29:16.4610000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T17:49:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8944]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:29:16.4750000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T15:27:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8945]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:29:16.4970000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8946]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:29:16.4970000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T01:25:34.000000000Z) unloaded successfully. 

Event[8947]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:29:16.4970000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8948]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:29:16.5030000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T15:01:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8949]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:29:16.5100000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T14:47:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8950]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:29:16.5170000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T07:53:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[8951]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:29:16.8580000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[8952]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:29:16.8580000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[8953]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:29:16.8580000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[8954]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T15:29:16.9020000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[8955]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-15T15:29:17.0820000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[8956]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:29:17.0830000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8957]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:29:17.0830000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8958]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:29:17.0830000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8959]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:29:17.0830000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8960]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:29:17.0830000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8961]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:29:17.0830000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8962]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:29:17.0830000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8963]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:29:17.0830000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8964]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:29:17.0830000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8965]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:29:17.0830000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8966]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:29:17.0830000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8967]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:29:17.0830000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8968]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:29:17.0830000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8969]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:29:17.0830000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[8970]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T15:29:18.1090000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[8971]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:29:18.2460000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[8972]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:29:18.2810000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[8973]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:29:18.3980000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[8974]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:29:18.3980000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000060-0000000000.json for detailed information on what checks were made. 

Event[8975]
  Log Name: System
  Source: TPM
  Date: 2025-10-15T15:29:22.2640000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[8976]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:29:24.7890000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[8977]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:29:25.6530000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[8978]
  Log Name: System
  Source: User32
  Date: 2025-10-15T15:29:27.4030000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\WINDOWS\system32\winlogon.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: No title for this reason could be found
 Reason Code: 0x500ff
 Shutdown Type: power off
 Comment:  

Event[8979]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:29:33.0980000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[8980]
  Log Name: System
  Source: winsrvext
  Date: 2025-10-15T15:29:32.4810000Z
  Event ID: 100
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Process C:\Windows\explorer.exe is delaying system shutdown after 5016 milliseconds. 

Event[8981]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-15T15:29:32.8290000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[8982]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:29:33.0890000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[8983]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:29:33.0890000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[8984]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T15:29:33.0900000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[8985]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:29:33.0920000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[8986]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:32:28.1570000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[8987]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:32:28.1570000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[8988]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T15:32:28.1580000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 4 seconds. 

Event[8989]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T15:29:33.1930000Z
  Event ID: 51057
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service stop is almost done.DHCP Context Ref count is 1 

Event[8990]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:29:33.1930000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[8991]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:29:33.8040000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[8992]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:29:33.8180000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[8993]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:29:38.0600000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[8994]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:29:38.3780000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[8995]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:29:38.6510000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?15T11:29:38.651898300Z. 

Event[8996]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:32:23.9290000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?15T11:32:23.500000000Z. 

Event[8997]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:32:23.9290000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?15T11:32:23.500000000Z. 

Loader time: ?2025?-?10?-?15T11:32:22.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[8998]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:32:23.9290000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[8999]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:32:23.9290000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[9000]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:32:23.9290000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[9001]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:32:23.9290000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[9002]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:32:23.9290000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[9003]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:32:23.9290000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?15T15:32:22.000000000Z. 

Event[9004]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:32:23.9290000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[9005]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:32:23.9290000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[9006]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-15T15:32:23.9330000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[9007]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:32:23.9330000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[9008]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-15T15:32:23.9640000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[9009]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-15T15:32:24.1260000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[9010]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:32:24.5120000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T05:29:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9011]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:32:24.5130000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T06:58:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9012]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:32:24.5140000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T13:57:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9013]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:32:24.9000000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[9014]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:32:24.9830000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T02:07:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9015]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:32:24.9880000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T02:42:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9016]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:32:25.0950000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T13:13:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9017]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:32:25.1280000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[9018]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:32:25.1280000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[9019]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:32:25.1300000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[9020]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-15T15:32:25.6550000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[9021]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:32:25.6980000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[9022]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:32:25.7290000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[9023]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:32:25.7310000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[9024]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:32:25.7320000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[9025]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:32:25.7330000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[9026]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:32:25.7340000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[9027]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:32:25.7350000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[9028]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-15T15:32:25.7400000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[9029]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:32:25.7410000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[9030]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:32:25.7450000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[9031]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:32:25.8110000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[9032]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:32:26.2760000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[9033]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T15:32:26.4780000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[9034]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:32:26.5450000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -240. 

Event[9035]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:32:27.2270000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[9036]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:32:27.2270000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[9037]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:32:27.2270000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[9038]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:32:27.2290000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[9039]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:32:27.3270000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[9040]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-15T15:32:27.3290000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[9041]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-15T15:32:27.3800000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[9042]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:32:27.5570000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[9043]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:32:27.5670000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[9044]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-15T15:32:27.5670000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[9045]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:32:28.0160000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T18:58:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9046]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:32:28.0260000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T06:02:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9047]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:32:28.0310000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T17:49:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9048]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:32:28.0440000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T15:27:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9049]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:32:28.0610000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9050]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:32:28.0610000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T01:25:34.000000000Z) unloaded successfully. 

Event[9051]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:32:28.0620000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9052]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:32:28.0680000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T15:01:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9053]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:32:28.0740000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T14:47:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9054]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-15T15:32:28.0820000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T07:53:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9055]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:32:28.3890000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[9056]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:32:28.3890000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[9057]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T15:32:28.3890000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[9058]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T15:32:28.4170000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[9059]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:32:28.6220000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9060]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:32:28.6220000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9061]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:32:28.6220000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9062]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:32:28.6220000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9063]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:32:28.6220000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9064]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:32:28.6220000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9065]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:32:28.6220000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9066]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:32:28.6220000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9067]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:32:28.6220000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9068]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:32:28.6220000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9069]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:32:28.6220000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9070]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:32:28.6220000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9071]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:32:28.6220000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9072]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T15:32:28.6220000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9073]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-15T15:32:28.6730000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[9074]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:32:29.9280000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[9075]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:32:29.9280000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000061-0000000000.json for detailed information on what checks were made. 

Event[9076]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T15:32:30.3350000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[9077]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:32:30.4540000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[9078]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T15:32:30.4870000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[9079]
  Log Name: System
  Source: TPM
  Date: 2025-10-15T15:32:34.2710000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[9080]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:32:37.1920000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[9081]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:32:37.9860000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[9082]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:33:36.3400000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 0 to 1.

Reason SessionUnlock 

BootId: 61 

Event[9083]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:33:36.8650000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[9084]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:33:36.8860000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[9085]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:33:36.9020000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[9086]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:33:36.9020000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[9087]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:33:36.9020000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[9088]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:33:36.9020000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[9089]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:33:36.9020000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[9090]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-15T15:33:36.9020000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[9091]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:34:07.0010000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 1 to 3.

Reason InputHid 

BootId: 61 

Event[9092]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T15:34:36.7550000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[9093]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:37:28.8050000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[9094]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-15T15:37:28.8050000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[9095]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:37:46.1050000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 3 to 4.

Reason SessionUnlock 

BootId: 61 

Event[9096]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:38:55.5040000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 4 to 6.

Reason SxTransition 

BootId: 61 

Event[9097]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:38:56.2200000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9098]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:38:59.7580000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9099]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:39:03.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T11:39:03.500000000Z from ?2025?-?10?-?15T11:38:59.758051500Z.
Time Delta: 3741 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T15:39:03.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9100]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:39:03.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 1, FullResume: 735, AverageResume: 735 

Event[9101]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:39:03.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 402684, SuspendEnd: 402684 

Event[9102]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:39:03.6780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 6 to 7.

Reason SxTransition 

BootId: 61 

Event[9103]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:39:04.3890000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 7 to 9.

Reason Unknown 

BootId: 61 

Event[9104]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T15:39:04.7250000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T11:38:55.492183000Z
Wake Time: ?2025?-?10?-?15T11:39:03.682522200Z

Wake Source: Power Button 

Event[9105]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:40:05.6510000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 9 to 10.

Reason SessionUnlock 

BootId: 61 

Event[9106]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:41:29.2640000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 10 to 12.

Reason SxTransition 

BootId: 61 

Event[9107]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:41:29.6270000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9108]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:41:30.7070000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9109]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:41:33.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T11:41:33.500000000Z from ?2025?-?10?-?15T11:41:30.707125100Z.
Time Delta: 2792 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T15:41:33.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9110]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:41:33.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 2, FullResume: 829, AverageResume: 782 

Event[9111]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:41:33.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 549897, SuspendEnd: 549898 

Event[9112]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:41:33.6810000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 12 to 13.

Reason SxTransition 

BootId: 61 

Event[9113]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:41:34.4060000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 13 to 15.

Reason Unknown 

BootId: 61 

Event[9114]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T15:41:34.6870000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T11:41:29.253224300Z
Wake Time: ?2025?-?10?-?15T11:41:33.666997200Z

Wake Source: Power Button 

Event[9115]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:42:34.5860000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 15 to 16.

Reason SessionUnlock 

BootId: 61 

Event[9116]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:44:02.0960000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 16 to 18.

Reason SxTransition 

BootId: 61 

Event[9117]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:44:02.4560000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9118]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:44:03.9580000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9119]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:44:08.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T11:44:08.500000000Z from ?2025?-?10?-?15T11:44:03.958812300Z.
Time Delta: 4541 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T15:44:08.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9120]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:44:08.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 3, FullResume: 697, AverageResume: 753 

Event[9121]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:44:08.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 700366, SuspendEnd: 700366 

Event[9122]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:44:08.6760000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 18 to 19.

Reason SxTransition 

BootId: 61 

Event[9123]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:44:09.3820000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 19 to 21.

Reason Unknown 

BootId: 61 

Event[9124]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T15:44:09.7110000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T11:44:02.080958100Z
Wake Time: ?2025?-?10?-?15T11:44:08.679277000Z

Wake Source: Power Button 

Event[9125]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T15:58:35.6340000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[9126]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:58:39.0550000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 21 to 22.

Reason SessionUnlock 

BootId: 61 

Event[9127]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T15:59:35.2440000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 22 to 24.

Reason InputHid 

BootId: 61 

Event[9128]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:00:35.4430000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 24 to 25.

Reason SessionUnlock 

BootId: 61 

Event[9129]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:01:36.5780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 25 to 27.

Reason SxTransition 

BootId: 61 

Event[9130]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:01:37.2160000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9131]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:01:38.4080000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9132]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T16:01:41.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T12:01:41.500000000Z from ?2025?-?10?-?15T12:01:38.408572300Z.
Time Delta: 3091 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T16:01:41.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9133]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:01:41.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 4, FullResume: 727, AverageResume: 747 

Event[9134]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:01:41.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 1750249, SuspendEnd: 1750250 

Event[9135]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:01:41.6780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 27 to 28.

Reason SxTransition 

BootId: 61 

Event[9136]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:01:42.3580000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 28 to 30.

Reason Unknown 

BootId: 61 

Event[9137]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T16:01:42.6870000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T12:01:36.566564100Z
Wake Time: ?2025?-?10?-?15T12:01:41.664795200Z

Wake Source: Power Button 

Event[9138]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T16:02:52.7370000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from demand start to auto start. 

Event[9139]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T16:06:32.1970000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from auto start to demand start. 

Event[9140]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T16:08:00.6390000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container MicrosoftWindows.Client.CBS_1000.26100.234.0_x64__cw5n1h2txyewy SID (S-1-15-2-283421221-3183566570-1718213290-751554359-3541592344-2312209569-3374928651). This security permission can be modified using the Component Services administrative tool. 

Event[9141]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:11:06.0690000Z
  Event ID: 187
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
User-mode process attempted to change the system state by calling SetSuspendState or SetSystemPowerState APIs. 

Event[9142]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:11:06.0810000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 30 to 31.

Reason Unknown 

BootId: 61 

Event[9143]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:11:07.2290000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: Application API 

Event[9144]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:11:09.1370000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9145]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T16:11:12.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T12:11:12.500000000Z from ?2025?-?10?-?15T12:11:09.137546500Z.
Time Delta: 3362 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T16:11:12.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9146]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:11:12.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 5, FullResume: 689, AverageResume: 735 

Event[9147]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:11:12.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 2317880, SuspendEnd: 2317880 

Event[9148]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:11:12.6760000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 31 to 32.

Reason SxTransition 

BootId: 61 

Event[9149]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:11:13.3830000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 32 to 34.

Reason Unknown 

BootId: 61 

Event[9150]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T16:11:13.6970000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T12:11:06.069041900Z
Wake Time: ?2025?-?10?-?15T12:11:12.670245300Z

Wake Source: Power Button 

Event[9151]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T16:13:13.8080000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume ?? (\Device\HarddiskVolumeShadowCopy10) is healthy.  No action is needed. 

Event[9152]
  Log Name: System
  Source: Volsnap
  Date: 2025-10-15T16:13:23.0350000Z
  Event ID: 95
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The oldest shadow copy of volume C: was deleted to allow shadow copies created afterward and marked for delete to be deleted. 

Event[9153]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T16:16:02.6400000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume ?? (\Device\HarddiskVolumeShadowCopy11) is healthy.  No action is needed. 

Event[9154]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T16:16:31.2360000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Intel(R) Driver & Support Assistant service was changed from disabled to auto start. 

Event[9155]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-15T16:16:31.2360000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Intel(R) Driver & Support Assistant Updater service was changed from disabled to auto start. 

Event[9156]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T16:16:36.2370000Z
  Event ID: 111
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events triggered on a URL group, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Create URL group 0xFE00000520000001. Status 0x0. Process Id 0x2624 Executable path \Device\HarddiskVolume3\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAService.exe, User S-1-5-18 

Event[9157]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T16:16:36.2380000Z
  Event ID: 113
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events triggered on a URL group, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to add URL (http://127.0.0.1:28390:127.0.0.1/) to URL group (0xFE00000520000001). Status: 0x0. Process Id 0x2624 Executable path \Device\HarddiskVolume3\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAService.exe, User S-1-5-18 

Event[9158]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T16:16:36.4620000Z
  Event ID: 111
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events triggered on a URL group, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Create URL group 0xFC00000520000001. Status 0x0. Process Id 0x2624 Executable path \Device\HarddiskVolume3\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAService.exe, User S-1-5-18 

Event[9159]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-15T16:16:36.4630000Z
  Event ID: 113
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events triggered on a URL group, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to add URL (http://127.0.0.1:28385:127.0.0.1/intel/) to URL group (0xFC00000520000001). Status: 0x0. Process Id 0x2624 Executable path \Device\HarddiskVolume3\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAService.exe, User S-1-5-18 

Event[9160]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T16:16:44.7490000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume ?? (\Device\HarddiskVolumeShadowCopy12) is healthy.  No action is needed. 

Event[9161]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T16:17:46.9840000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 2 keys and creating 1 modified pages. 

Event[9162]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T16:24:15.0050000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Settings\settings.dat was cleared updating 3 keys and creating 1 modified pages. 

Event[9163]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-15T16:28:32.4770000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume ?? (\Device\HarddiskVolumeShadowCopy13) is healthy.  No action is needed. 

Event[9164]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T16:28:44.0890000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9165]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T16:28:44.1400000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9166]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T16:28:44.3240000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[9167]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T16:28:44.3270000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[9168]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T16:28:44.3290000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[9169]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-15T16:28:44.3290000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
 and APPID 
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[9170]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-15T16:31:22.9230000Z
  Event ID: 8000
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
8000 - Miniport Halt flow (driver disable) 

Event[9171]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-15T16:31:23.8040000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP6 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[9172]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-15T16:31:23.8790000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[9173]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T16:31:23.9570000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelWifiIhv04.dll
 

Event[9174]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T16:31:24.0780000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelIHVRouter04.dll
 

Event[9175]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:33:39.6600000Z
  Event ID: 187
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
User-mode process attempted to change the system state by calling SetSuspendState or SetSystemPowerState APIs. 

Event[9176]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:33:39.6720000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 34 to 35.

Reason Unknown 

BootId: 61 

Event[9177]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:33:40.7980000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: Application API 

Event[9178]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:33:44.1420000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9179]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T16:33:47.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T12:33:47.500000000Z from ?2025?-?10?-?15T12:33:44.142417200Z.
Time Delta: 3357 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T16:33:47.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9180]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:33:47.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 6, FullResume: 712, AverageResume: 731 

Event[9181]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:33:47.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 3669486, SuspendEnd: 3669486 

Event[9182]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:33:47.6690000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 35 to 36.

Reason SxTransition 

BootId: 61 

Event[9183]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:33:48.4120000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 36 to 38.

Reason Unknown 

BootId: 61 

Event[9184]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T16:33:48.7770000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T12:33:39.658305100Z
Wake Time: ?2025?-?10?-?15T12:33:47.672332100Z

Wake Source: Power Button 

Event[9185]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T16:33:50.7290000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9186]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T16:33:50.7590000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9187]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:35:05.2660000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 38 to 39.

Reason SessionUnlock 

BootId: 61 

Event[9188]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:35:45.9410000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 39 to 41.

Reason InputHid 

BootId: 61 

Event[9189]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:37:38.6410000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 41 to 42.

Reason SessionUnlock 

BootId: 61 

Event[9190]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:38:46.4140000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 42 to 44.

Reason SxTransition 

BootId: 61 

Event[9191]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:38:47.0610000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9192]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:38:48.1780000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9193]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T16:38:52.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T12:38:52.500000000Z from ?2025?-?10?-?15T12:38:48.178332300Z.
Time Delta: 4321 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T16:38:52.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9194]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:38:52.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 7, FullResume: 713, AverageResume: 729 

Event[9195]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:38:52.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 3970166, SuspendEnd: 3970166 

Event[9196]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:38:52.6790000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 44 to 45.

Reason SxTransition 

BootId: 61 

Event[9197]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:38:53.4270000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 45 to 47.

Reason Unknown 

BootId: 61 

Event[9198]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T16:38:53.7040000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T12:38:46.402119100Z
Wake Time: ?2025?-?10?-?15T12:38:52.667402400Z

Wake Source: Power Button 

Event[9199]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T16:38:55.9170000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9200]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T16:38:55.9450000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9201]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:39:53.6410000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 47 to 48.

Reason SessionUnlock 

BootId: 61 

Event[9202]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:41:20.6990000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 48 to 50.

Reason SxTransition 

BootId: 61 

Event[9203]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:41:21.0700000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9204]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:41:22.6250000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9205]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T16:41:25.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T12:41:25.500000000Z from ?2025?-?10?-?15T12:41:22.625696600Z.
Time Delta: 2874 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T16:41:25.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9206]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:41:25.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 8, FullResume: 703, AverageResume: 725 

Event[9207]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:41:25.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 4120300, SuspendEnd: 4120301 

Event[9208]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:41:25.6820000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 50 to 51.

Reason SxTransition 

BootId: 61 

Event[9209]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:41:26.3970000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 51 to 53.

Reason Unknown 

BootId: 61 

Event[9210]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T16:41:26.7010000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T12:41:20.688507300Z
Wake Time: ?2025?-?10?-?15T12:41:25.668491700Z

Wake Source: Power Button 

Event[9211]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T16:41:28.7230000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9212]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T16:41:28.7500000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9213]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:42:26.6670000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 53 to 54.

Reason SessionUnlock 

BootId: 61 

Event[9214]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:43:52.8830000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 54 to 56.

Reason InputHid 

BootId: 61 

Event[9215]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:51:15.6450000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 56 to 57.

Reason SessionUnlock 

BootId: 61 

Event[9216]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:51:30.9180000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 57 to 59.

Reason InputHid 

BootId: 61 

Event[9217]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:55:56.6310000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 59 to 60.

Reason SessionUnlock 

BootId: 61 

Event[9218]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T16:57:00.0860000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 60 to 62.

Reason InputHid 

BootId: 61 

Event[9219]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:02:16.2010000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 62 to 63.

Reason SessionUnlock 

BootId: 61 

Event[9220]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:02:22.8540000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 63 to 65.

Reason InputHid 

BootId: 61 

Event[9221]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:04:33.7270000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 65 to 66.

Reason SessionUnlock 

BootId: 61 

Event[9222]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:05:36.6070000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 66 to 68.

Reason InputHid 

BootId: 61 

Event[9223]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:27:48.3280000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 68 to 69.

Reason SessionUnlock 

BootId: 61 

Event[9224]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:28:13.7260000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 69 to 71.

Reason InputHid 

BootId: 61 

Event[9225]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:30:39.7740000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 71 to 72.

Reason SessionUnlock 

BootId: 61 

Event[9226]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:30:49.0720000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 72 to 74.

Reason InputHid 

BootId: 61 

Event[9227]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:33:05.1180000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 74 to 75.

Reason SessionUnlock 

BootId: 61 

Event[9228]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:33:57.6130000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 75 to 77.

Reason InputHid 

BootId: 61 

Event[9229]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:35:59.2500000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 77 to 78.

Reason SessionUnlock 

BootId: 61 

Event[9230]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:36:25.6860000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 78 to 80.

Reason InputHid 

BootId: 61 

Event[9231]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:46:18.8770000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 80 to 81.

Reason SessionUnlock 

BootId: 61 

Event[9232]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:46:51.4800000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 81 to 83.

Reason InputHid 

BootId: 61 

Event[9233]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:47:54.9950000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 83 to 84.

Reason SessionUnlock 

BootId: 61 

Event[9234]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:49:23.6450000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 84 to 86.

Reason SxTransition 

BootId: 61 

Event[9235]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:49:24.3020000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9236]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:49:25.6020000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9237]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T17:49:29.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T13:49:29.500000000Z from ?2025?-?10?-?15T13:49:25.602612900Z.
Time Delta: 3897 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T17:49:29.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9238]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:49:29.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 9, FullResume: 705, AverageResume: 723 

Event[9239]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:49:29.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 8200264, SuspendEnd: 8200265 

Event[9240]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:49:29.6770000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 86 to 87.

Reason SxTransition 

BootId: 61 

Event[9241]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:49:30.3820000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 87 to 89.

Reason Unknown 

BootId: 61 

Event[9242]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T17:49:30.7030000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T13:49:23.632147900Z
Wake Time: ?2025?-?10?-?15T13:49:29.667840100Z

Wake Source: Power Button 

Event[9243]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T17:49:32.9520000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9244]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T17:49:32.9810000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9245]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:52:36.8830000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 89 to 90.

Reason SessionUnlock 

BootId: 61 

Event[9246]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:53:57.4760000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 90 to 92.

Reason SxTransition 

BootId: 61 

Event[9247]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:53:57.8290000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9248]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:53:59.4330000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9249]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T17:54:03.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T13:54:03.500000000Z from ?2025?-?10?-?15T13:53:59.433252000Z.
Time Delta: 4066 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T17:54:03.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9250]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:54:03.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 10, FullResume: 691, AverageResume: 720 

Event[9251]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:54:03.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 8470200, SuspendEnd: 8470201 

Event[9252]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:54:03.6810000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 92 to 93.

Reason SxTransition 

BootId: 61 

Event[9253]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:54:04.3830000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 93 to 95.

Reason Unknown 

BootId: 61 

Event[9254]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T17:54:04.7160000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T13:53:57.464933100Z
Wake Time: ?2025?-?10?-?15T13:54:03.682690200Z

Wake Source: Power Button 

Event[9255]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T17:54:06.9320000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9256]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T17:54:06.9580000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9257]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:55:04.6820000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 95 to 96.

Reason SessionUnlock 

BootId: 61 

Event[9258]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:56:31.5350000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 96 to 98.

Reason SxTransition 

BootId: 61 

Event[9259]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:56:31.8920000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9260]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:56:33.4330000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9261]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T17:56:36.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T13:56:36.500000000Z from ?2025?-?10?-?15T13:56:33.433603100Z.
Time Delta: 3066 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T17:56:36.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9262]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:56:36.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 11, FullResume: 703, AverageResume: 718 

Event[9263]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:56:36.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 8620143, SuspendEnd: 8620143 

Event[9264]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:56:36.6790000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 98 to 99.

Reason SxTransition 

BootId: 61 

Event[9265]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:56:37.4140000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 99 to 101.

Reason Unknown 

BootId: 61 

Event[9266]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T17:56:37.7020000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T13:56:31.522412100Z
Wake Time: ?2025?-?10?-?15T13:56:36.670132500Z

Wake Source: Power Button 

Event[9267]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T17:56:39.7730000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9268]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T17:56:39.8200000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9269]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:57:37.5770000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 101 to 102.

Reason SessionUnlock 

BootId: 61 

Event[9270]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:58:56.5570000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 102 to 104.

Reason InputHid 

BootId: 61 

Event[9271]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T17:59:56.8340000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 104 to 105.

Reason SessionUnlock 

BootId: 61 

Event[9272]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:00:48.9670000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 105 to 107.

Reason InputHid 

BootId: 61 

Event[9273]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:01:52.2550000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 107 to 108.

Reason SessionUnlock 

BootId: 61 

Event[9274]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:03:04.6660000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 108 to 110.

Reason SxTransition 

BootId: 61 

Event[9275]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:03:05.0250000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9276]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:03:08.3270000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9277]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T18:03:12.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T14:03:12.500000000Z from ?2025?-?10?-?15T14:03:08.327908000Z.
Time Delta: 4172 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T18:03:12.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9278]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:03:12.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 12, FullResume: 692, AverageResume: 716 

Event[9279]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:03:12.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 9011970, SuspendEnd: 9011970 

Event[9280]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:03:12.6800000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 110 to 111.

Reason SxTransition 

BootId: 61 

Event[9281]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:03:13.4240000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 111 to 113.

Reason Unknown 

BootId: 61 

Event[9282]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T18:03:13.7070000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T14:03:04.655330400Z
Wake Time: ?2025?-?10?-?15T14:03:12.678245700Z

Wake Source: Power Button 

Event[9283]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:03:15.7820000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9284]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:03:15.8270000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9285]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:06:10.2330000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 113 to 114.

Reason SessionUnlock 

BootId: 61 

Event[9286]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:07:38.7750000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 114 to 116.

Reason SxTransition 

BootId: 61 

Event[9287]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:07:39.1310000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9288]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:07:40.1640000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9289]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T18:07:43.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T14:07:43.500000000Z from ?2025?-?10?-?15T14:07:40.164273300Z.
Time Delta: 3335 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T18:07:43.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9290]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:07:43.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 13, FullResume: 700, AverageResume: 715 

Event[9291]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:07:43.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 9279637, SuspendEnd: 9279637 

Event[9292]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:07:43.6740000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 116 to 117.

Reason SxTransition 

BootId: 61 

Event[9293]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:07:44.3880000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 117 to 119.

Reason Unknown 

BootId: 61 

Event[9294]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T18:07:44.6860000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T14:07:38.763866300Z
Wake Time: ?2025?-?10?-?15T14:07:43.671759900Z

Wake Source: Power Button 

Event[9295]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:07:46.7720000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9296]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:07:46.8280000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9297]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:09:30.9340000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 119 to 120.

Reason SessionUnlock 

BootId: 61 

Event[9298]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:10:42.1270000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 120 to 122.

Reason SxTransition 

BootId: 61 

Event[9299]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:10:42.4740000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9300]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:10:43.5130000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9301]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T18:10:46.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T14:10:46.500000000Z from ?2025?-?10?-?15T14:10:43.513331800Z.
Time Delta: 2986 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T18:10:46.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9302]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:10:46.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 14, FullResume: 781, AverageResume: 720 

Event[9303]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:10:46.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 9459657, SuspendEnd: 9459657 

Event[9304]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:10:46.6790000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 122 to 123.

Reason SxTransition 

BootId: 61 

Event[9305]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:10:47.3690000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 123 to 125.

Reason Unknown 

BootId: 61 

Event[9306]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T18:10:47.7180000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T14:10:42.105093400Z
Wake Time: ?2025?-?10?-?15T14:10:46.670320000Z

Wake Source: Power Button 

Event[9307]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:10:49.7390000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9308]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:10:49.7820000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9309]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:11:47.5310000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 125 to 126.

Reason SessionUnlock 

BootId: 61 

Event[9310]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:12:07.4320000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 126 to 128.

Reason InputHid 

BootId: 61 

Event[9311]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:13:07.7500000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 128 to 129.

Reason SessionUnlock 

BootId: 61 

Event[9312]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:14:15.1100000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 129 to 131.

Reason SxTransition 

BootId: 61 

Event[9313]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:14:15.4690000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9314]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:14:16.4910000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9315]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T18:14:20.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T14:14:20.500000000Z from ?2025?-?10?-?15T14:14:16.491727300Z.
Time Delta: 4008 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T18:14:20.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9316]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:14:20.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 15, FullResume: 720, AverageResume: 720 

Event[9317]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:14:20.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 9669655, SuspendEnd: 9669655 

Event[9318]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:14:20.6720000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 131 to 132.

Reason SxTransition 

BootId: 61 

Event[9319]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:14:21.3850000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 132 to 134.

Reason Unknown 

BootId: 61 

Event[9320]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T18:14:21.6980000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T14:14:15.096544300Z
Wake Time: ?2025?-?10?-?15T14:14:20.665493000Z

Wake Source: Power Button 

Event[9321]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:14:23.7340000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9322]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:14:23.7730000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9323]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:15:21.5840000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 134 to 135.

Reason SessionUnlock 

BootId: 61 

Event[9324]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:16:49.1680000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 135 to 137.

Reason SxTransition 

BootId: 61 

Event[9325]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:16:49.5420000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9326]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:16:51.0680000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9327]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T18:16:54.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T14:16:54.500000000Z from ?2025?-?10?-?15T14:16:51.068174600Z.
Time Delta: 3431 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T18:16:54.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9328]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:16:54.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 16, FullResume: 722, AverageResume: 720 

Event[9329]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:16:54.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 9820232, SuspendEnd: 9820232 

Event[9330]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:16:54.6880000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 137 to 138.

Reason SxTransition 

BootId: 61 

Event[9331]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:16:55.4120000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 138 to 140.

Reason Unknown 

BootId: 61 

Event[9332]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T18:16:55.7010000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T14:16:49.157452800Z
Wake Time: ?2025?-?10?-?15T14:16:54.678673800Z

Wake Source: Power Button 

Event[9333]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:16:57.7220000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9334]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:16:57.7650000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9335]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:18:44.8190000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 140 to 141.

Reason SessionUnlock 

BootId: 61 

Event[9336]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:19:52.5520000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 141 to 143.

Reason SxTransition 

BootId: 61 

Event[9337]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:19:52.9060000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9338]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:19:54.4080000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9339]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T18:19:58.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T14:19:58.500000000Z from ?2025?-?10?-?15T14:19:54.408893500Z.
Time Delta: 4091 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T18:19:58.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9340]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:19:58.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 17, FullResume: 696, AverageResume: 718 

Event[9341]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:19:58.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 10000148, SuspendEnd: 10000149 

Event[9342]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:19:58.6790000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 143 to 144.

Reason SxTransition 

BootId: 61 

Event[9343]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:19:59.4070000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 144 to 146.

Reason Unknown 

BootId: 61 

Event[9344]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T18:19:59.6980000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T14:19:52.542026000Z
Wake Time: ?2025?-?10?-?15T14:19:58.667207000Z

Wake Source: Power Button 

Event[9345]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:20:01.7350000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9346]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:20:01.7700000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9347]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:20:59.6500000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 146 to 147.

Reason SessionUnlock 

BootId: 61 

Event[9348]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:22:26.6280000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 147 to 149.

Reason SxTransition 

BootId: 61 

Event[9349]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:22:27.0000000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9350]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:22:28.0050000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9351]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T18:22:31.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T14:22:31.500000000Z from ?2025?-?10?-?15T14:22:28.005249600Z.
Time Delta: 3494 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T18:22:31.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9352]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:22:31.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 18, FullResume: 723, AverageResume: 719 

Event[9353]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:22:31.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 10149661, SuspendEnd: 10149662 

Event[9354]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:22:31.6740000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 149 to 150.

Reason SxTransition 

BootId: 61 

Event[9355]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:22:32.4140000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 150 to 152.

Reason Unknown 

BootId: 61 

Event[9356]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T18:22:32.7170000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T14:22:26.616419000Z
Wake Time: ?2025?-?10?-?15T14:22:31.678603800Z

Wake Source: Power Button 

Event[9357]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:22:34.7870000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9358]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:22:34.8310000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9359]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:23:31.7230000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 152 to 153.

Reason SessionUnlock 

BootId: 61 

Event[9360]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:25:00.1520000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 153 to 155.

Reason SxTransition 

BootId: 61 

Event[9361]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:25:00.5120000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9362]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:25:01.5660000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9363]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T18:25:04.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T14:25:04.500000000Z from ?2025?-?10?-?15T14:25:01.566812300Z.
Time Delta: 2933 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T18:25:04.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9364]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:25:04.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 19, FullResume: 725, AverageResume: 719 

Event[9365]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:25:04.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 10299736, SuspendEnd: 10299737 

Event[9366]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:25:04.6780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 155 to 156.

Reason SxTransition 

BootId: 61 

Event[9367]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:25:05.3950000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 156 to 158.

Reason Unknown 

BootId: 61 

Event[9368]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T18:25:05.6950000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T14:25:00.138501500Z
Wake Time: ?2025?-?10?-?15T14:25:04.662495900Z

Wake Source: Power Button 

Event[9369]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:25:07.9310000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9370]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:25:07.9710000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9371]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:26:51.9030000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 158 to 159.

Reason SessionUnlock 

BootId: 61 

Event[9372]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:28:03.0960000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 159 to 161.

Reason SxTransition 

BootId: 61 

Event[9373]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:28:03.4650000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9374]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:28:04.5280000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9375]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T18:28:08.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T14:28:08.500000000Z from ?2025?-?10?-?15T14:28:04.528320600Z.
Time Delta: 3971 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T18:28:08.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9376]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:28:08.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 20, FullResume: 694, AverageResume: 718 

Event[9377]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:28:08.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 10479771, SuspendEnd: 10479772 

Event[9378]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:28:08.6790000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 161 to 162.

Reason SxTransition 

BootId: 61 

Event[9379]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:28:09.3910000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 162 to 164.

Reason Unknown 

BootId: 61 

Event[9380]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T18:28:09.6970000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T14:28:03.082850300Z
Wake Time: ?2025?-?10?-?15T14:28:08.675157600Z

Wake Source: Power Button 

Event[9381]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:28:11.9100000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9382]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:28:11.9460000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9383]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:29:08.7610000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 164 to 165.

Reason SessionUnlock 

BootId: 61 

Event[9384]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:29:37.6780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 165 to 167.

Reason InputHid 

BootId: 61 

Event[9385]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:32:22.8660000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 167 to 168.

Reason SessionUnlock 

BootId: 61 

Event[9386]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:32:30.5630000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 168 to 170.

Reason InputHid 

BootId: 61 

Event[9387]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:33:33.8330000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 170 to 171.

Reason SessionUnlock 

BootId: 61 

Event[9388]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:34:37.0860000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 171 to 173.

Reason SxTransition 

BootId: 61 

Event[9389]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:34:37.4390000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9390]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:34:38.5110000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9391]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T18:34:42.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T14:34:42.500000000Z from ?2025?-?10?-?15T14:34:38.511107800Z.
Time Delta: 3988 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T18:34:42.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9392]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:34:42.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 21, FullResume: 700, AverageResume: 717 

Event[9393]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:34:42.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 10869781, SuspendEnd: 10869782 

Event[9394]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:34:42.6730000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 173 to 174.

Reason SxTransition 

BootId: 61 

Event[9395]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:34:43.4320000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 174 to 176.

Reason Unknown 

BootId: 61 

Event[9396]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T18:34:43.7030000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T14:34:37.075347900Z
Wake Time: ?2025?-?10?-?15T14:34:42.671205300Z

Wake Source: Power Button 

Event[9397]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:34:45.9380000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9398]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:34:45.9760000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9399]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:35:43.6890000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 176 to 177.

Reason SessionUnlock 

BootId: 61 

Event[9400]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:37:11.0420000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 177 to 179.

Reason SxTransition 

BootId: 61 

Event[9401]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:37:11.4090000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9402]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:37:12.4540000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9403]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T18:37:15.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T14:37:15.500000000Z from ?2025?-?10?-?15T14:37:12.454537500Z.
Time Delta: 3045 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T18:37:15.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9404]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:37:15.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 22, FullResume: 728, AverageResume: 717 

Event[9405]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:37:15.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 11019744, SuspendEnd: 11019745 

Event[9406]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:37:15.6760000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 179 to 180.

Reason SxTransition 

BootId: 61 

Event[9407]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:37:16.3980000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 180 to 182.

Reason Unknown 

BootId: 61 

Event[9408]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T18:37:16.7010000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T14:37:11.031007100Z
Wake Time: ?2025?-?10?-?15T14:37:15.665555000Z

Wake Source: Power Button 

Event[9409]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:37:18.7220000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9410]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:37:18.7530000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9411]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:38:16.6580000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 182 to 183.

Reason SessionUnlock 

BootId: 61 

Event[9412]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:39:44.0670000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 183 to 185.

Reason SxTransition 

BootId: 61 

Event[9413]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:39:44.4310000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9414]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:39:45.4860000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9415]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T18:39:49.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T14:39:49.500000000Z from ?2025?-?10?-?15T14:39:45.486179800Z.
Time Delta: 4013 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T18:39:49.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9416]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:39:49.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 23, FullResume: 723, AverageResume: 718 

Event[9417]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:39:49.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 11169737, SuspendEnd: 11169738 

Event[9418]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:39:49.6780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 185 to 186.

Reason SxTransition 

BootId: 61 

Event[9419]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:39:50.3790000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 186 to 188.

Reason Unknown 

BootId: 61 

Event[9420]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T18:39:50.7140000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T14:39:44.056353800Z
Wake Time: ?2025?-?10?-?15T14:39:49.669862400Z

Wake Source: Power Button 

Event[9421]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:39:52.7160000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9422]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:39:52.7440000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9423]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:40:50.6580000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 188 to 189.

Reason SessionUnlock 

BootId: 61 

Event[9424]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:41:22.3550000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 189 to 191.

Reason InputHid 

BootId: 61 

Event[9425]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:42:22.6430000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 191 to 192.

Reason SessionUnlock 

BootId: 61 

Event[9426]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:43:48.1130000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 192 to 194.

Reason SxTransition 

BootId: 61 

Event[9427]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:43:48.4730000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9428]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:43:49.5140000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9429]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T18:43:52.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T14:43:52.500000000Z from ?2025?-?10?-?15T14:43:49.514217700Z.
Time Delta: 2985 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T18:43:52.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9430]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:43:52.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 24, FullResume: 704, AverageResume: 717 

Event[9431]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:43:52.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 11409758, SuspendEnd: 11409758 

Event[9432]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:43:52.6730000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 194 to 195.

Reason SxTransition 

BootId: 61 

Event[9433]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:43:53.3830000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 195 to 197.

Reason Unknown 

BootId: 61 

Event[9434]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T18:43:53.6880000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T14:43:48.102707900Z
Wake Time: ?2025?-?10?-?15T14:43:52.670860000Z

Wake Source: Power Button 

Event[9435]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:43:55.7260000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9436]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:43:55.7590000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9437]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:45:45.9330000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 197 to 198.

Reason SessionUnlock 

BootId: 61 

Event[9438]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:46:51.1070000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 198 to 200.

Reason SxTransition 

BootId: 61 

Event[9439]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:46:51.4710000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9440]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:46:52.5360000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9441]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T18:46:56.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T14:46:56.500000000Z from ?2025?-?10?-?15T14:46:52.536347600Z.
Time Delta: 3963 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T18:46:56.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9442]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:46:56.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 25, FullResume: 725, AverageResume: 717 

Event[9443]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:46:56.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 11589802, SuspendEnd: 11589803 

Event[9444]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:46:56.6710000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 200 to 201.

Reason SxTransition 

BootId: 61 

Event[9445]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:46:57.4330000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 201 to 203.

Reason Unknown 

BootId: 61 

Event[9446]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T18:46:57.6950000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T14:46:51.095047700Z
Wake Time: ?2025?-?10?-?15T14:46:56.675129800Z

Wake Source: Power Button 

Event[9447]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:46:59.9790000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9448]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:47:00.0100000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9449]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:47:57.6650000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 203 to 204.

Reason SessionUnlock 

BootId: 61 

Event[9450]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:49:25.0290000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 204 to 206.

Reason SxTransition 

BootId: 61 

Event[9451]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:49:25.3820000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9452]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:49:26.9420000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9453]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T18:49:30.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T14:49:30.500000000Z from ?2025?-?10?-?15T14:49:26.941959300Z.
Time Delta: 3558 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T18:49:30.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9454]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:49:30.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 26, FullResume: 702, AverageResume: 717 

Event[9455]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:49:30.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 11740252, SuspendEnd: 11740252 

Event[9456]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:49:30.6760000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 206 to 207.

Reason SxTransition 

BootId: 61 

Event[9457]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:49:31.3810000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 207 to 209.

Reason Unknown 

BootId: 61 

Event[9458]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T18:49:31.7120000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T14:49:25.016510000Z
Wake Time: ?2025?-?10?-?15T14:49:30.677785500Z

Wake Source: Power Button 

Event[9459]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:49:33.7230000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9460]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:49:33.7550000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9461]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:50:31.6600000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 209 to 210.

Reason SessionUnlock 

BootId: 61 

Event[9462]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:50:59.1440000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 210 to 212.

Reason InputHid 

BootId: 61 

Event[9463]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:52:02.4200000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 212 to 213.

Reason SessionUnlock 

BootId: 61 

Event[9464]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:53:28.5970000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 213 to 215.

Reason SxTransition 

BootId: 61 

Event[9465]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:53:28.9560000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9466]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:53:30.5370000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9467]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T18:53:33.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T14:53:33.500000000Z from ?2025?-?10?-?15T14:53:30.537836200Z.
Time Delta: 2962 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T18:53:33.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9468]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:53:33.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 27, FullResume: 697, AverageResume: 716 

Event[9469]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:53:33.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 11980297, SuspendEnd: 11980297 

Event[9470]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:53:33.6750000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 215 to 216.

Reason SxTransition 

BootId: 61 

Event[9471]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:53:34.4260000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 216 to 218.

Reason Unknown 

BootId: 61 

Event[9472]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T18:53:34.7020000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T14:53:28.586331300Z
Wake Time: ?2025?-?10?-?15T14:53:33.670071000Z

Wake Source: Power Button 

Event[9473]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:53:36.8060000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9474]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:53:36.8630000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9475]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:54:36.7610000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 218 to 219.

Reason SessionUnlock 

BootId: 61 

Event[9476]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:56:01.5700000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 219 to 221.

Reason SxTransition 

BootId: 61 

Event[9477]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:56:01.9210000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9478]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:56:03.0370000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9479]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T18:56:06.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T14:56:06.500000000Z from ?2025?-?10?-?15T14:56:03.037276200Z.
Time Delta: 3462 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T18:56:06.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9480]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:56:06.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 28, FullResume: 721, AverageResume: 716 

Event[9481]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:56:06.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 12129843, SuspendEnd: 12129844 

Event[9482]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:56:06.6770000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 221 to 222.

Reason SxTransition 

BootId: 61 

Event[9483]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:56:07.3890000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 222 to 224.

Reason Unknown 

BootId: 61 

Event[9484]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T18:56:07.7050000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T14:56:01.555664400Z
Wake Time: ?2025?-?10?-?15T14:56:06.679421900Z

Wake Source: Power Button 

Event[9485]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:56:09.7150000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9486]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:56:09.7460000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9487]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:57:07.6800000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 224 to 225.

Reason SessionUnlock 

BootId: 61 

Event[9488]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:58:35.0330000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 225 to 227.

Reason SxTransition 

BootId: 61 

Event[9489]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:58:35.3710000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9490]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:58:36.4070000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9491]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T18:58:40.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T14:58:40.500000000Z from ?2025?-?10?-?15T14:58:36.407174700Z.
Time Delta: 4092 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T18:58:40.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9492]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:58:40.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 29, FullResume: 686, AverageResume: 715 

Event[9493]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:58:40.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 12279757, SuspendEnd: 12279758 

Event[9494]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:58:40.6780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 227 to 228.

Reason SxTransition 

BootId: 61 

Event[9495]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:58:41.4130000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 228 to 230.

Reason Unknown 

BootId: 61 

Event[9496]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T18:58:41.7100000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T14:58:35.022950200Z
Wake Time: ?2025?-?10?-?15T14:58:40.669667600Z

Wake Source: Power Button 

Event[9497]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:58:43.7530000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9498]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T18:58:43.7900000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9499]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T18:59:41.6150000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 230 to 231.

Reason SessionUnlock 

BootId: 61 

Event[9500]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:01:09.1640000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 231 to 233.

Reason SxTransition 

BootId: 61 

Event[9501]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:01:09.5170000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9502]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:01:11.0390000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9503]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T19:01:14.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T15:01:14.500000000Z from ?2025?-?10?-?15T15:01:11.039177200Z.
Time Delta: 3460 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T19:01:14.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9504]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:01:14.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 30, FullResume: 708, AverageResume: 715 

Event[9505]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:01:14.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 12430304, SuspendEnd: 12430304 

Event[9506]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:01:14.6710000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 233 to 234.

Reason SxTransition 

BootId: 61 

Event[9507]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:01:15.4180000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 234 to 236.

Reason Unknown 

BootId: 61 

Event[9508]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T19:01:15.7020000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T15:01:09.151146500Z
Wake Time: ?2025?-?10?-?15T15:01:14.677227200Z

Wake Source: Power Button 

Event[9509]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T19:01:17.9820000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9510]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T19:01:18.0220000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9511]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:02:15.6430000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 236 to 237.

Reason SessionUnlock 

BootId: 61 

Event[9512]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:03:42.5900000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 237 to 239.

Reason SxTransition 

BootId: 61 

Event[9513]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:03:42.9960000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9514]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:03:44.5830000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9515]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T19:03:48.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T15:03:48.500000000Z from ?2025?-?10?-?15T15:03:44.583412100Z.
Time Delta: 3916 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T19:03:48.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9516]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:03:48.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 31, FullResume: 715, AverageResume: 715 

Event[9517]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:03:48.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 12580396, SuspendEnd: 12580397 

Event[9518]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:03:48.6760000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 239 to 240.

Reason SxTransition 

BootId: 61 

Event[9519]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:03:49.3950000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 240 to 242.

Reason Unknown 

BootId: 61 

Event[9520]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T19:03:49.6980000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T15:03:42.578135600Z
Wake Time: ?2025?-?10?-?15T15:03:48.664885700Z

Wake Source: Power Button 

Event[9521]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T19:03:51.7260000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9522]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T19:03:51.7550000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9523]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:04:49.6070000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 242 to 243.

Reason SessionUnlock 

BootId: 61 

Event[9524]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:06:16.4940000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 243 to 245.

Reason SxTransition 

BootId: 61 

Event[9525]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:06:16.8130000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9526]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:06:18.3290000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9527]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T19:06:21.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T15:06:21.500000000Z from ?2025?-?10?-?15T15:06:18.329554400Z.
Time Delta: 3170 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T19:06:21.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9528]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:06:21.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 32, FullResume: 717, AverageResume: 715 

Event[9529]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:06:21.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 12730235, SuspendEnd: 12730235 

Event[9530]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:06:21.6700000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 245 to 246.

Reason SxTransition 

BootId: 61 

Event[9531]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:06:22.3880000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 246 to 248.

Reason Unknown 

BootId: 61 

Event[9532]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T19:06:22.7040000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T15:06:16.482767800Z
Wake Time: ?2025?-?10?-?15T15:06:21.666091700Z

Wake Source: Power Button 

Event[9533]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T19:06:24.9190000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9534]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T19:06:24.9590000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9535]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:07:22.5450000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 248 to 249.

Reason SessionUnlock 

BootId: 61 

Event[9536]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:08:49.6650000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 249 to 251.

Reason SxTransition 

BootId: 61 

Event[9537]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:08:50.0200000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9538]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:08:51.0690000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9539]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T19:08:54.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T15:08:54.500000000Z from ?2025?-?10?-?15T15:08:51.069786400Z.
Time Delta: 3430 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T19:08:54.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9540]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:08:54.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 33, FullResume: 695, AverageResume: 714 

Event[9541]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:08:54.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 12879811, SuspendEnd: 12879812 

Event[9542]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:08:54.6790000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 251 to 252.

Reason SxTransition 

BootId: 61 

Event[9543]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:08:55.3980000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 252 to 254.

Reason Unknown 

BootId: 61 

Event[9544]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T19:08:55.7000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T15:08:49.651612300Z
Wake Time: ?2025?-?10?-?15T15:08:54.667430800Z

Wake Source: Power Button 

Event[9545]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T19:08:57.9370000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9546]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T19:08:57.9680000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9547]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:09:55.6430000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 254 to 255.

Reason SessionUnlock 

BootId: 61 

Event[9548]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:11:23.0960000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 255 to 257.

Reason SxTransition 

BootId: 61 

Event[9549]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:11:23.4780000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9550]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:11:24.5250000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9551]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T19:11:28.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T15:11:28.500000000Z from ?2025?-?10?-?15T15:11:24.525530800Z.
Time Delta: 3974 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T19:11:28.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9552]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:11:28.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 34, FullResume: 700, AverageResume: 714 

Event[9553]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:11:28.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 13029846, SuspendEnd: 13029846 

Event[9554]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:11:28.6780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 257 to 258.

Reason SxTransition 

BootId: 61 

Event[9555]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:11:29.3790000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 258 to 260.

Reason Unknown 

BootId: 61 

Event[9556]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T19:11:29.7040000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T15:11:23.083310600Z
Wake Time: ?2025?-?10?-?15T15:11:28.674703700Z

Wake Source: Power Button 

Event[9557]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T19:11:31.9230000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9558]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T19:11:31.9550000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9559]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:12:29.6470000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 260 to 261.

Reason SessionUnlock 

BootId: 61 

Event[9560]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:13:57.0830000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 261 to 263.

Reason SxTransition 

BootId: 61 

Event[9561]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:13:57.4400000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9562]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:13:58.9690000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9563]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T19:14:02.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T15:14:02.500000000Z from ?2025?-?10?-?15T15:13:58.969834700Z.
Time Delta: 3530 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T19:14:02.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9564]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:14:02.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 35, FullResume: 727, AverageResume: 714 

Event[9565]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:14:02.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 13180327, SuspendEnd: 13180328 

Event[9566]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:14:02.6780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 263 to 264.

Reason SxTransition 

BootId: 61 

Event[9567]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:14:03.3930000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 264 to 266.

Reason Unknown 

BootId: 61 

Event[9568]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T19:14:03.6970000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T15:13:57.070307200Z
Wake Time: ?2025?-?10?-?15T15:14:02.673733800Z

Wake Source: Power Button 

Event[9569]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T19:14:05.7450000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9570]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T19:14:05.8040000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9571]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:15:03.7020000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 266 to 267.

Reason SessionUnlock 

BootId: 61 

Event[9572]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:16:30.5910000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 267 to 269.

Reason SxTransition 

BootId: 61 

Event[9573]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:16:30.9470000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9574]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:16:32.0010000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9575]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T19:16:35.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T15:16:35.500000000Z from ?2025?-?10?-?15T15:16:32.001888300Z.
Time Delta: 3498 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T19:16:35.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9576]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:16:35.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 36, FullResume: 692, AverageResume: 714 

Event[9577]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:16:35.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 13329836, SuspendEnd: 13329837 

Event[9578]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:16:35.6780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 269 to 270.

Reason SxTransition 

BootId: 61 

Event[9579]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:16:36.3970000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 270 to 272.

Reason Unknown 

BootId: 61 

Event[9580]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T19:16:36.7000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T15:16:30.579459100Z
Wake Time: ?2025?-?10?-?15T15:16:35.673332100Z

Wake Source: Power Button 

Event[9581]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T19:16:38.7110000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9582]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T19:16:38.7370000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9583]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:17:36.6870000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 272 to 273.

Reason SessionUnlock 

BootId: 61 

Event[9584]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:19:04.1390000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 273 to 275.

Reason SxTransition 

BootId: 61 

Event[9585]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:19:04.5010000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9586]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:19:06.0200000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9587]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T19:19:09.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T15:19:09.500000000Z from ?2025?-?10?-?15T15:19:06.020459900Z.
Time Delta: 3479 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T19:19:09.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9588]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:19:09.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 37, FullResume: 701, AverageResume: 713 

Event[9589]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:19:09.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 13480369, SuspendEnd: 13480369 

Event[9590]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:19:09.6760000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 275 to 276.

Reason SxTransition 

BootId: 61 

Event[9591]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:19:10.4080000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 276 to 278.

Reason Unknown 

BootId: 61 

Event[9592]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T19:19:10.7140000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T15:19:04.128684000Z
Wake Time: ?2025?-?10?-?15T15:19:09.681479200Z

Wake Source: Power Button 

Event[9593]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T19:19:12.7800000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9594]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T19:19:12.8210000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9595]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:20:10.7170000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 278 to 279.

Reason SessionUnlock 

BootId: 61 

Event[9596]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:21:37.5770000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 279 to 281.

Reason SxTransition 

BootId: 61 

Event[9597]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:21:37.9420000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9598]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:21:39.4900000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9599]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T19:21:43.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T15:21:43.500000000Z from ?2025?-?10?-?15T15:21:39.490680200Z.
Time Delta: 4009 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T19:21:43.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9600]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:21:43.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 38, FullResume: 808, AverageResume: 716 

Event[9601]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:21:43.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 13630371, SuspendEnd: 13630371 

Event[9602]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:21:43.6740000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 281 to 282.

Reason SxTransition 

BootId: 61 

Event[9603]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:21:44.3870000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 282 to 284.

Reason Unknown 

BootId: 61 

Event[9604]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T19:21:44.7040000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T15:21:37.565722800Z
Wake Time: ?2025?-?10?-?15T15:21:43.678197400Z

Wake Source: Power Button 

Event[9605]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T19:21:46.7120000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9606]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T19:21:46.7410000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9607]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:22:44.6850000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 284 to 285.

Reason SessionUnlock 

BootId: 61 

Event[9608]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:24:11.6410000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 285 to 287.

Reason SxTransition 

BootId: 61 

Event[9609]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:24:11.9970000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9610]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:24:13.5310000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9611]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T19:24:16.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T15:24:16.500000000Z from ?2025?-?10?-?15T15:24:13.531635800Z.
Time Delta: 2968 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T19:24:16.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9612]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:24:16.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 39, FullResume: 701, AverageResume: 716 

Event[9613]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:24:16.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 13780412, SuspendEnd: 13780413 

Event[9614]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:24:16.6760000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 287 to 288.

Reason SxTransition 

BootId: 61 

Event[9615]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:24:17.4070000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 288 to 290.

Reason Unknown 

BootId: 61 

Event[9616]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T19:24:17.7070000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T15:24:11.628681500Z
Wake Time: ?2025?-?10?-?15T15:24:16.677462900Z

Wake Source: Power Button 

Event[9617]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T19:24:19.9590000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9618]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T19:24:19.9990000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9619]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:25:16.7340000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 290 to 291.

Reason SessionUnlock 

BootId: 61 

Event[9620]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:26:44.5880000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 291 to 293.

Reason SxTransition 

BootId: 61 

Event[9621]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:26:44.9460000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9622]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:26:46.4680000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9623]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T19:26:50.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T15:26:50.500000000Z from ?2025?-?10?-?15T15:26:46.468441500Z.
Time Delta: 4031 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T19:26:50.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9624]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:26:50.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 40, FullResume: 699, AverageResume: 715 

Event[9625]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:26:50.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 13930391, SuspendEnd: 13930392 

Event[9626]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:26:50.6770000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 293 to 294.

Reason SxTransition 

BootId: 61 

Event[9627]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:26:51.4010000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 294 to 296.

Reason Unknown 

BootId: 61 

Event[9628]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T19:26:51.7030000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T15:26:44.576180000Z
Wake Time: ?2025?-?10?-?15T15:26:50.682893700Z

Wake Source: Power Button 

Event[9629]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T19:26:53.7630000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9630]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T19:26:53.8030000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9631]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:27:51.6460000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 296 to 297.

Reason SessionUnlock 

BootId: 61 

Event[9632]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:29:18.5960000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 297 to 299.

Reason SxTransition 

BootId: 61 

Event[9633]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:29:18.9530000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9634]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:29:20.5020000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9635]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T19:29:24.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T15:29:24.500000000Z from ?2025?-?10?-?15T15:29:20.502655400Z.
Time Delta: 3997 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T19:29:24.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9636]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:29:24.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 41, FullResume: 701, AverageResume: 715 

Event[9637]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:29:24.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 14080401, SuspendEnd: 14080402 

Event[9638]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:29:24.6780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 299 to 300.

Reason SxTransition 

BootId: 61 

Event[9639]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:29:25.3810000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 300 to 302.

Reason Unknown 

BootId: 61 

Event[9640]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T19:29:25.6970000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T15:29:18.585508700Z
Wake Time: ?2025?-?10?-?15T15:29:24.672052000Z

Wake Source: Power Button 

Event[9641]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T19:29:27.7240000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9642]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T19:29:27.7510000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9643]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:33:44.0750000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 302 to 303.

Reason SessionUnlock 

BootId: 61 

Event[9644]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T19:33:53.6200000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 303 to 305.

Reason InputHid 

BootId: 61 

Event[9645]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:11:42.5660000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 305 to 306.

Reason SessionUnlock 

BootId: 61 

Event[9646]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:12:52.5800000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 306 to 308.

Reason SxTransition 

BootId: 61 

Event[9647]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:12:52.9280000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9648]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:12:54.6810000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9649]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T20:12:57.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T16:12:57.500000000Z from ?2025?-?10?-?15T16:12:54.681385000Z.
Time Delta: 2818 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T20:12:57.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9650]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:12:57.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 42, FullResume: 806, AverageResume: 717 

Event[9651]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:12:57.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 16690499, SuspendEnd: 16690500 

Event[9652]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:12:57.6860000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 308 to 309.

Reason SxTransition 

BootId: 61 

Event[9653]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:12:58.4260000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 309 to 311.

Reason Unknown 

BootId: 61 

Event[9654]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T20:12:58.6990000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T16:12:52.568533500Z
Wake Time: ?2025?-?10?-?15T16:12:57.662183300Z

Wake Source: Power Button 

Event[9655]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T20:13:00.7760000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9656]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T20:13:00.8270000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9657]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:14:09.7530000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 311 to 312.

Reason SessionUnlock 

BootId: 61 

Event[9658]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:15:25.3860000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 312 to 314.

Reason SxTransition 

BootId: 61 

Event[9659]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:15:25.7540000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9660]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:15:27.3530000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9661]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T20:15:31.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?15T16:15:31.500000000Z from ?2025?-?10?-?15T16:15:27.353352200Z.
Time Delta: 4146 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?15T20:15:31.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9662]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:15:31.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 43, FullResume: 730, AverageResume: 717 

Event[9663]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:15:31.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 16840361, SuspendEnd: 16840361 

Event[9664]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:15:31.6760000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 314 to 315.

Reason SxTransition 

BootId: 61 

Event[9665]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:15:32.3830000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 315 to 317.

Reason Unknown 

BootId: 61 

Event[9666]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-15T20:15:32.6970000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?15T16:15:25.385763500Z
Wake Time: ?2025?-?10?-?15T16:15:31.668138100Z

Wake Source: Power Button 

Event[9667]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T20:15:34.7240000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9668]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-15T20:15:34.7630000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9669]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:16:32.6940000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 317 to 318.

Reason SessionUnlock 

BootId: 61 

Event[9670]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:17:16.0320000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 318 to 320.

Reason InputHid 

BootId: 61 

Event[9671]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:18:19.3360000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 320 to 321.

Reason SessionUnlock 

BootId: 61 

Event[9672]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:18:47.8510000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 321 to 323.

Reason InputHid 

BootId: 61 

Event[9673]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:20:15.2000000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 323 to 324.

Reason SessionUnlock 

BootId: 61 

Event[9674]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:20:53.4480000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 324 to 326.

Reason InputHid 

BootId: 61 

Event[9675]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:23:33.1090000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 326 to 327.

Reason SessionUnlock 

BootId: 61 

Event[9676]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:23:41.4330000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 327 to 329.

Reason InputHid 

BootId: 61 

Event[9677]
  Log Name: System
  Source: User32
  Date: 2025-10-15T20:59:14.7850000Z
  Event ID: 1074
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The process C:\WINDOWS\system32\winlogon.exe (256GB-SSD) has initiated the power off of computer 256GB-SSD on behalf of user 256GB-SSD\aaron for the following reason: No title for this reason could be found
 Reason Code: 0x500ff
 Shutdown Type: power off
 Comment:  

Event[9678]
  Log Name: System
  Source: EventLog
  Date: 2025-10-15T20:59:16.4370000Z
  Event ID: 6006
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was stopped. 

Event[9679]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-15T20:59:15.9860000Z
  Event ID: 7002
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logoff Notification for Customer Experience Improvement Program 

Event[9680]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T20:59:16.4270000Z
  Event ID: 50104
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client received shutdown notification 

Event[9681]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T20:59:16.4270000Z
  Event ID: 50105
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client ProcessDHCPRequestForever received TERMINATE_EVENT 

Event[9682]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T20:59:16.4290000Z
  Event ID: 51047
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is stopped. ShutDown Flag value is 1 

Event[9683]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-15T20:59:16.4290000Z
  Event ID: 51057
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service stop is almost done.DHCP Context Ref count is 1 

Event[9684]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T20:59:16.4330000Z
  Event ID: 50106
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 is waiting on DHCPv6 service to stop 

Event[9685]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-15T20:59:16.4330000Z
  Event ID: 50037
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is stopped. ShutDown Flag value is 1 

Event[9686]
  Log Name: System
  Source: EventLog
  Date: 2025-10-16T07:49:16.3300000Z
  Event ID: 6009
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Microsoft (R) Windows (R) 10.00. 26100  Multiprocessor Free. 

Event[9687]
  Log Name: System
  Source: EventLog
  Date: 2025-10-16T07:49:16.3340000Z
  Event ID: 6005
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The Event log service was started. 

Event[9688]
  Log Name: System
  Source: EventLog
  Date: 2025-10-16T07:49:16.3350000Z
  Event ID: 6013
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system uptime is 8 seconds. 

Event[9689]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T20:59:17.1110000Z
  Event ID: 10002
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has stopped.

Module Path: C:\WINDOWS\system32\IntelIHVRouter04.dll
 

Event[9690]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-15T20:59:17.1310000Z
  Event ID: 4001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully stopped.
 

Event[9691]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:59:17.1480000Z
  Event ID: 109
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The kernel power manager has initiated a shutdown transition.

Action: Power Action Shutdown Off 
Event Code: 0x0 
Reason: Kernel API 

Event[9692]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-15T20:59:19.8980000Z
  Event ID: 577
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has prepared for a system initiated reboot from Active. 

Event[9693]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-15T20:59:20.1440000Z
  Event ID: 13
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The operating system is shutting down at system time ?2025?-?10?-?15T16:59:20.144220000Z. 

Event[9694]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T07:49:07.9060000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The operating system started at system time ?2025?-?10?-?16T03:49:07.500000000Z. 

Event[9695]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T07:49:07.9060000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system time was initialized to ?2025?-?10?-?16T03:49:07.500000000Z. 

Loader time: ?2025?-?10?-?16T03:49:06.000000000Z
Internal boot flags: 0x2
HAL RTC error code: 0x0
RTC time is in UTC: false
Soft boot: false
Success: true
Phase: 0 

Event[9696]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-16T07:49:07.9070000Z
  Event ID: 153
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization-based security (policies: 0) is disabled. 

Event[9697]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-16T07:49:07.9070000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
There are 0x1 boot options on this system. 

Event[9698]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-16T07:49:07.9070000Z
  Event ID: 32
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The bootmgr spent 0 ms waiting for user input. 

Event[9699]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-16T07:49:07.9070000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The last shutdown's success status was true. The last boot's success status was true. 

Event[9700]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-16T07:49:07.9070000Z
  Event ID: 247
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Unable to load Pluton-Windows firmware. StatusCode: STATUS_SUCCESS, Reason: Failed to apply firmware. 

Event[9701]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-16T07:49:07.9070000Z
  Event ID: 238
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
EFI time zone bias: 2047. Daylight flags: 0. Firmware time: ?2025?-?10?-?16T07:49:06.000000000Z. 

Event[9702]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-16T07:49:07.9070000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot menu policy was 0x1. 

Event[9703]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-16T07:49:07.9070000Z
  Event ID: 27
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The boot type was 0x0. 

Event[9704]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Boot
  Date: 2025-10-16T07:49:07.9110000Z
  Event ID: 30
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The firmware reported boot metrics. 

Event[9705]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T07:49:07.9110000Z
  Event ID: 20
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The leap second configuration has been updated.
Reason: Leap second data initialized from registry during boot
Leap seconds enabled: true
New leap second count: 0
Old leap second count: 0 

Event[9706]
  Log Name: System
  Source: Microsoft-Windows-HAL
  Date: 2025-10-16T07:49:07.9490000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
IOMMU fault reporting has been initialized. 

Event[9707]
  Log Name: System
  Source: Application Popup
  Date: 2025-10-16T07:49:08.0990000Z
  Event ID: 56
  Task: N/A
  Level: Error 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
N/A

Event[9708]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-16T07:49:08.3040000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileInfo' (10.0, ?2093?-?04?-?02T05:29:43.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9709]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-16T07:49:08.3050000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'Wof' (10.0, ?2089?-?07?-?15T06:58:05.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9710]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-16T07:49:08.3070000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'WdFilter' (10.0, ?2028?-?06?-?06T13:57:32.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9711]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-16T07:49:08.7110000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume C: (\Device\HarddiskVolume3) is healthy.  No action is needed. 

Event[9712]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-16T07:49:08.8980000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'FileCrypt' (10.0, ?2075?-?09?-?01T02:07:07.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9713]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-16T07:49:08.9050000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UCPD' (10.0, ?2047?-?11?-?06T02:42:35.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9714]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-16T07:49:09.1390000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'npsvctrig' (10.0, ?1978?-?05?-?14T13:13:30.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9715]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T07:49:09.2110000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ00 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[9716]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T07:49:09.2110000Z
  Event ID: 125
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
ACPI thermal zone \_TZ.TZ01 has been enumerated.             
_PSV = 0K             
_TC1 = 0             
_TC2 = 0             
_TSP = 0ms             
_AC0 = 0K             
_AC1 = 0K             
_AC2 = 0K             
_AC3 = 0K             
_AC4 = 0K             
_AC5 = 0K             
_AC6 = 0K             
_AC7 = 0K             
_AC8 = 0K             
_AC9 = 0K             
_CRT = 0K             
_HOT = 0K             
minimum throttle = 0             
_CR3 = 0K 

Event[9717]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T07:49:09.2180000Z
  Event ID: 172
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Connectivity state in standby: Disconnected, Reason: NIC compliance 

Event[9718]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-16T07:49:10.1990000Z
  Event ID: 7036
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The \Device\NDMP1 service entered the Intel(R) Dual Band Wireless-AC 3165 state. 

Event[9719]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-16T07:49:10.2370000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 0 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[9720]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-16T07:49:10.2480000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 2 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[9721]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-16T07:49:10.2490000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 4 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[9722]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-16T07:49:10.2610000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 6 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[9723]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-16T07:49:10.2740000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 1 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[9724]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-16T07:49:10.2750000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 3 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[9725]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-16T07:49:10.2760000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 5 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[9726]
  Log Name: System
  Source: Netwtw04
  Date: 2025-10-16T07:49:10.2800000Z
  Event ID: 7010
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
7010 - driver enabled (miniport init) 

Event[9727]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-16T07:49:10.3360000Z
  Event ID: 55
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Processor 7 in group 0 exposes the following power management capabilities:

Idle state type: ACPI Idle (C) States (3 state(s))

Performance state type: ACPI Performance (P) / Throttle (T) States
Nominal Frequency (MHz): 2601
Maximum performance percentage: 100
Minimum performance percentage: 30
Minimum throttle percentage: 3 

Event[9728]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T07:49:10.3410000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[9729]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T07:49:10.3930000Z
  Event ID: 521
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Active battery count change. 

Event[9730]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-16T07:49:11.1080000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume D: (\Device\HarddiskVolume8) is healthy.  No action is needed. 

Event[9731]
  Log Name: System
  Source: Microsoft-Windows-Ntfs
  Date: 2025-10-16T07:49:11.3330000Z
  Event ID: 98
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Volume \\?\Volume{34031c21-8558-4833-8ef1-7d71d5f7c752} (\Device\HarddiskVolume4) is healthy.  No action is needed. 

Event[9732]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T07:49:11.4050000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The time zone information was refreshed with exit reason 0. Current time zone bias is -240. 

Event[9733]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T07:49:14.4530000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9734]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T07:49:14.4990000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9735]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-16T07:49:14.8650000Z
  Event ID: 19
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Virtualization Based Security new timer creation status

HRESULT: The operation completed successfully.
New latch timer needed: false
New latch timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
Policy file exists: false
 

Event[9736]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-16T07:49:14.8660000Z
  Event ID: 24
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Timer start completed with status:

Win32Error: 0
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Due time: ?2025?-?11?-?15T14:46:42.743709700Z
 

Event[9737]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-16T07:49:14.8660000Z
  Event ID: 25
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Previous timer resumed with status:

HRESULT: The operation completed successfully.
Previous timer present: true
Start time: ?2025?-?09?-?16T14:46:42.743709700Z
Grace period: 51840000000000
Attempted recovery enforcement succeeded: false
 

Event[9738]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-16T07:49:14.8670000Z
  Event ID: 23
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Boot App Anti-Rollback: Initialize Completed with status:
HRESULT: The operation completed successfully.
New timer needed: false
New timer waiting for system update completion: false
Previous latch timer exists but disabled by registry: false
 

Event[9739]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-16T07:49:14.9590000Z
  Event ID: 14
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard configuration:

Registry Configuration: 0x0
Test Configuration: 0
Auto Enablement: 0 

Event[9740]
  Log Name: System
  Source: Microsoft-Windows-Wininit
  Date: 2025-10-16T07:49:14.9610000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
LSASS.exe was started as a protected process with level: 4. 

Event[9741]
  Log Name: System
  Source: LsaSrv
  Date: 2025-10-16T07:49:15.0130000Z
  Event ID: 6156
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Credential Guard auto enablement status.

Hardware Requirements for Virtualization Based Security:	1
Domain Joined:	0
Azure AD Joined:	0
 Licensed for Credential Guard:	0
Domain Controller:	0 

Event[9742]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-16T07:49:15.1810000Z
  Event ID: 16962
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Remote calls to the SAM database are being restricted using the default security descriptor: O:SYG:SYD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651. 

Event[9743]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-16T07:49:15.1910000Z
  Event ID: 16977
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The domain is configured with the following minimum password length-related settings.

MinimumPasswordLength: 0

RelaxMinimumPasswordLengthLimits: 0

MinimumPasswordLengthAudit: -1

For more information see https://go.microsoft.com/fwlink/?LinkId=2097191.
 

Event[9744]
  Log Name: System
  Source: Microsoft-Windows-Directory-Services-SAM
  Date: 2025-10-16T07:49:15.1910000Z
  Event ID: 16983
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The security account manager is now logging periodic summary events for remote clients that call legacy password change or set RPC methods.

For more information please see https://go.microsoft.com/fwlink/?linkid=2150956.
 

Event[9745]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-16T07:49:16.1580000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'applockerfltr' (10.0, ?2033?-?08?-?20T17:49:08.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9746]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-16T07:49:16.1640000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bfs' (10.0, ?1977?-?11?-?21T18:58:49.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9747]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-16T07:49:16.1750000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'wcifs' (10.0, ?2017?-?09?-?25T06:02:57.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9748]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-16T07:49:16.1930000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'luafv' (10.0, ?2080?-?03?-?25T15:27:53.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9749]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-16T07:49:16.2140000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9750]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-16T07:49:16.2140000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (Version 10.0, ?2089?-?09?-?04T01:25:34.000000000Z) unloaded successfully. 

Event[9751]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-16T07:49:16.2140000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'CldFlt' (10.0, ?2089?-?09?-?04T01:25:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9752]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-16T07:49:16.2190000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'UnionFS' (10.0, ?2047?-?02?-?21T15:01:20.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9753]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-16T07:49:16.2300000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'storqosflt' (10.0, ?2021?-?03?-?19T14:47:34.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9754]
  Log Name: System
  Source: Microsoft-Windows-FilterManager
  Date: 2025-10-16T07:49:16.2380000Z
  Event ID: 6
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
File System Filter 'bindflt' (10.0, ?1975?-?03?-?16T07:53:38.000000000Z) has successfully loaded and registered with Filter Manager. 

Event[9755]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-16T07:49:16.6270000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[9756]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-16T07:49:16.6270000Z
  Event ID: 50103
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client registered for shutdown notification 

Event[9757]
  Log Name: System
  Source: Microsoft-Windows-Dhcp-Client
  Date: 2025-10-16T07:49:16.6270000Z
  Event ID: 50036
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceShutdown  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv4 client service is started 

Event[9758]
  Log Name: System
  Source: Microsoft-Windows-DHCPv6-Client
  Date: 2025-10-16T07:49:16.6510000Z
  Event ID: 51046
  Task: Service State Event 
  Level: Information 
  Opcode: ServiceStop  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
DHCPv6 client service is started 

Event[9759]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-16T07:49:16.8130000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:5357/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9760]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-16T07:49:16.8130000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:80/Temporary_Listen_Addresses/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9761]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-16T07:49:16.8130000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://*:5358/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9762]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-16T07:49:16.8130000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://*:2869/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9763]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-16T07:49:16.8130000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:5986/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9764]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-16T07:49:16.8130000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:47001/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9765]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-16T07:49:16.8130000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:5985/wsman/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9766]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-16T07:49:16.8130000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:443/sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9767]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-16T07:49:16.8130000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10247/apps/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9768]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-16T07:49:16.8130000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:3392/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9769]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-16T07:49:16.8130000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:3387/rdp/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9770]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-16T07:49:16.8130000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL https://+:10245/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9771]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-16T07:49:16.8130000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10243/WMPNSSv4/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9772]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-16T07:49:16.8130000Z
  Event ID: 112
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events dealing with service setup, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to reserve URL http://+:10246/MDEServer/. Status 0x0. Process Id 0x4 Executable path , User S-1-5-18 

Event[9773]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-16T07:49:18.7430000Z
  Event ID: 1041
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health check detailed information: {"Version":1,"HealthStatus":"Attestable","Required":[{"Field":"TpmPresent","Value":true,"DesiredValue":true},{"Field":"TpmMeetsMinimumVersion","Value":true,"DesiredValue":true},{"Field":"TpmIsResponsive","Value":true,"DesiredValue":true},{"Field":"EkCertIsAvailable","Value":true,"DesiredValue":true},{"Field":"TcgLogFound","Value":true,"DesiredValue":true}],"Expected":[{"Field":"PcrsMatchTcgLog","Value":true,"DesiredValue":true}],"Informational":[{"Field":"SecureBootEnabled","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"VirtualSecureMemory","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true},{"Field":"SecureCorePCCompliant","ValueFromComputer":false,"ValueFromTcgLog":false,"DesiredValue":true,"TcgValueIsVerifiable":true}]} 

Event[9774]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-16T07:49:18.7430000Z
  Event ID: 1038
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Pre-attestation health checks confirm that the device is expected to pass attestation.
 Please see C:\WINDOWS\Logs\MeasuredBoot\0000000062-0000000000.json for detailed information on what checks were made. 

Event[9775]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-16T07:49:18.8700000Z
  Event ID: 111
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events triggered on a URL group, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Create URL group 0xFE00000220000001. Status 0x0. Process Id 0xEF8 Executable path \Device\HarddiskVolume3\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAService.exe, User S-1-5-18 

Event[9776]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-16T07:49:18.8710000Z
  Event ID: 113
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events triggered on a URL group, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to add URL (http://127.0.0.1:28390:127.0.0.1/) to URL group (0xFE00000220000001). Status: 0x0. Process Id 0xEF8 Executable path \Device\HarddiskVolume3\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAService.exe, User S-1-5-18 

Event[9777]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-16T07:49:18.8750000Z
  Event ID: 111
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events triggered on a URL group, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Create URL group 0xFE00000520000001. Status 0x0. Process Id 0xEF8 Executable path \Device\HarddiskVolume3\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAService.exe, User S-1-5-18 

Event[9778]
  Log Name: System
  Source: Microsoft-Windows-HttpService
  Date: 2025-10-16T07:49:18.8750000Z
  Event ID: 113
  Task: HTTP Setup Trace Task 
  Level: Information 
  Opcode: ResvUrlV2  
  Keyword: Flagged on all HTTP events triggered on a URL group, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Attempted to add URL (http://127.0.0.1:28385:127.0.0.1/intel/) to URL group (0xFE00000520000001). Status: 0x0. Process Id 0xEF8 Executable path \Device\HarddiskVolume3\Program Files (x86)\Intel\Driver and Support Assistant\x86\DSAService.exe, User S-1-5-18 

Event[9779]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-16T07:49:19.0240000Z
  Event ID: 7026
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The following boot-start or system-start driver(s) did not load: 
dam 

Event[9780]
  Log Name: System
  Source: TPM
  Date: 2025-10-16T07:49:19.0330000Z
  Event ID: 18
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
This event triggers the Trusted Platform Module (TPM) provisioning/status check to run. 

Event[9781]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-16T07:49:19.1760000Z
  Event ID: 4000
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN AutoConfig service has successfully started.
 

Event[9782]
  Log Name: System
  Source: Microsoft-Windows-WLAN-AutoConfig
  Date: 2025-10-16T07:49:19.2330000Z
  Event ID: 10001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
WLAN Extensibility Module has successfully started.

Module Path: C:\WINDOWS\system32\IntelIHVRouter04.dll
 

Event[9783]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-16T07:49:20.1830000Z
  Event ID: 1282
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TBS device identifier has been generated. 

Event[9784]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-16T07:49:23.0950000Z
  Event ID: 1025
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The TPM was successfully provisioned and is now ready for use. 

Event[9785]
  Log Name: System
  Source: Microsoft-Windows-Winlogon
  Date: 2025-10-16T07:49:31.6710000Z
  Event ID: 7001
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
User Logon Notification for Customer Experience Improvement Program 

Event[9786]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-16T07:49:32.1490000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[9787]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-16T07:49:32.1530000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[9788]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-16T07:50:21.3920000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 0 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[9789]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-16T07:50:21.4080000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[9790]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-16T07:50:21.4080000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 2 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[9791]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-16T07:50:21.4250000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 6 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[9792]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-16T07:50:21.4400000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 7 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[9793]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-16T07:50:21.4400000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 1 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[9794]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-16T07:50:21.4400000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 5 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[9795]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Processor-Power
  Date: 2025-10-16T07:50:21.4400000Z
  Event ID: 37
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The speed of processor 3 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report. 

Event[9796]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-16T07:51:25.5560000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID 
Windows.SecurityCenter.WscDataProtection
 and APPID 
Unavailable
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[9797]
  Log Name: System
  Source: Microsoft-Windows-DistributedCOM
  Date: 2025-10-16T07:52:34.0620000Z
  Event ID: 10016
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user 256GB-SSD\aaron SID (S-1-5-21-1511219319-3122627625-3827747853-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. 

Event[9798]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-16T07:54:16.9200000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[9799]
  Log Name: System
  Source: Microsoft-Windows-TPM-WMI
  Date: 2025-10-16T07:54:16.9200000Z
  Event ID: 1796
  Task: N/A
  Level: Error 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The Secure Boot update failed to update a Secure Boot variable with error Secure Boot is not enabled on this machine.. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931 

Event[9800]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T08:10:53.3880000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat was cleared updating 0 keys and creating 0 modified pages. 

Event[9801]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:19:33.4690000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 0 to 1.

Reason SessionUnlock 

BootId: 62 

Event[9802]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:20:39.5940000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 1 to 3.

Reason SxTransition 

BootId: 62 

Event[9803]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:20:40.2170000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9804]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:20:41.9590000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9805]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T08:20:45.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?16T04:20:45.500000000Z from ?2025?-?10?-?16T04:20:41.959248600Z.
Time Delta: 3540 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?16T08:20:45.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9806]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:20:45.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 1, FullResume: 731, AverageResume: 731 

Event[9807]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:20:45.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 1899561, SuspendEnd: 1899561 

Event[9808]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:20:45.6680000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 3 to 4.

Reason SxTransition 

BootId: 62 

Event[9809]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:20:46.3710000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 4 to 6.

Reason Unknown 

BootId: 62 

Event[9810]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-16T08:20:46.8270000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?16T04:20:39.581502600Z
Wake Time: ?2025?-?10?-?16T04:20:45.671139500Z

Wake Source: Power Button 

Event[9811]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:20:48.6840000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9812]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:20:48.7200000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9813]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-16T08:27:05.2220000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Brave Elevation Service (BraveElevationService) service was changed from disabled to demand start. 

Event[9814]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:27:08.5750000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 6 to 7.

Reason SessionUnlock 

BootId: 62 

Event[9815]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:28:13.1420000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 7 to 9.

Reason SxTransition 

BootId: 62 

Event[9816]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:28:13.7530000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9817]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:28:15.4470000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9818]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T08:28:18.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?16T04:28:18.500000000Z from ?2025?-?10?-?16T04:28:15.447794400Z.
Time Delta: 3052 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?16T08:28:18.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9819]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:28:18.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 2, FullResume: 709, AverageResume: 720 

Event[9820]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:28:18.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 2349207, SuspendEnd: 2349208 

Event[9821]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:28:18.6780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 9 to 10.

Reason SxTransition 

BootId: 62 

Event[9822]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:28:19.3550000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 10 to 12.

Reason Unknown 

BootId: 62 

Event[9823]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-16T08:28:19.6990000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?16T04:28:13.129680400Z
Wake Time: ?2025?-?10?-?16T04:28:18.665267300Z

Wake Source: Power Button 

Event[9824]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:28:21.7520000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9825]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:28:21.8080000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9826]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:29:19.6010000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 12 to 13.

Reason SessionUnlock 

BootId: 62 

Event[9827]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:30:46.2240000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 13 to 15.

Reason SxTransition 

BootId: 62 

Event[9828]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:30:46.5580000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9829]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:30:48.1130000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9830]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T08:30:52.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?16T04:30:52.500000000Z from ?2025?-?10?-?16T04:30:48.113922900Z.
Time Delta: 4386 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?16T08:30:52.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9831]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:30:52.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 3, FullResume: 721, AverageResume: 720 

Event[9832]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:30:52.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 2498727, SuspendEnd: 2498728 

Event[9833]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:30:52.6750000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 15 to 16.

Reason SxTransition 

BootId: 62 

Event[9834]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:30:53.3900000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 16 to 18.

Reason Unknown 

BootId: 62 

Event[9835]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-16T08:30:53.6930000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?16T04:30:46.212575900Z
Wake Time: ?2025?-?10?-?16T04:30:52.663628000Z

Wake Source: Power Button 

Event[9836]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:30:55.7480000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9837]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:30:55.7790000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9838]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:31:53.4950000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 18 to 19.

Reason SessionUnlock 

BootId: 62 

Event[9839]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:33:20.6080000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 19 to 21.

Reason SxTransition 

BootId: 62 

Event[9840]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:33:20.9520000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9841]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:33:22.0030000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9842]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T08:33:25.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?16T04:33:25.500000000Z from ?2025?-?10?-?16T04:33:22.003101900Z.
Time Delta: 3496 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?16T08:33:25.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9843]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:33:25.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 4, FullResume: 720, AverageResume: 720 

Event[9844]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:33:25.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 2648137, SuspendEnd: 2648137 

Event[9845]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:33:25.6740000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 21 to 22.

Reason SxTransition 

BootId: 62 

Event[9846]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:33:26.3840000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 22 to 24.

Reason Unknown 

BootId: 62 

Event[9847]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-16T08:33:26.7000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?16T04:33:20.594966400Z
Wake Time: ?2025?-?10?-?16T04:33:25.669399700Z

Wake Source: Power Button 

Event[9848]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:33:28.7300000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9849]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:33:28.7680000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9850]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:34:26.6210000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 24 to 25.

Reason SessionUnlock 

BootId: 62 

Event[9851]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:35:54.0640000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 25 to 27.

Reason SxTransition 

BootId: 62 

Event[9852]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:35:54.4350000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9853]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:35:55.9510000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9854]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T08:35:59.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?16T04:35:59.500000000Z from ?2025?-?10?-?16T04:35:55.951099500Z.
Time Delta: 3548 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?16T08:35:59.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9855]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:35:59.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 5, FullResume: 701, AverageResume: 716 

Event[9856]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:35:59.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 2798500, SuspendEnd: 2798500 

Event[9857]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:35:59.6760000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 27 to 28.

Reason SxTransition 

BootId: 62 

Event[9858]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:36:00.3860000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 28 to 30.

Reason Unknown 

BootId: 62 

Event[9859]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-16T08:36:00.6950000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?16T04:35:54.052722800Z
Wake Time: ?2025?-?10?-?16T04:35:59.670369100Z

Wake Source: Power Button 

Event[9860]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:36:02.6950000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9861]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:36:02.7270000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9862]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:37:00.5450000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 30 to 31.

Reason SessionUnlock 

BootId: 62 

Event[9863]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:38:27.7130000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 31 to 33.

Reason SxTransition 

BootId: 62 

Event[9864]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:38:28.0780000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9865]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:38:29.6080000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9866]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T08:38:33.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?16T04:38:33.500000000Z from ?2025?-?10?-?16T04:38:29.608391100Z.
Time Delta: 3891 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?16T08:38:33.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9867]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:38:33.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 6, FullResume: 692, AverageResume: 712 

Event[9868]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:38:33.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 2948516, SuspendEnd: 2948517 

Event[9869]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:38:33.6810000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 33 to 34.

Reason SxTransition 

BootId: 62 

Event[9870]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:38:34.4100000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 34 to 36.

Reason Unknown 

BootId: 62 

Event[9871]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-16T08:38:34.6950000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?16T04:38:27.696461000Z
Wake Time: ?2025?-?10?-?16T04:38:33.667081400Z

Wake Source: Power Button 

Event[9872]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:38:36.7720000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9873]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:38:36.8130000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9874]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:39:34.5480000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 36 to 37.

Reason SessionUnlock 

BootId: 62 

Event[9875]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:41:01.6020000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 37 to 39.

Reason SxTransition 

BootId: 62 

Event[9876]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:41:01.9530000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9877]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:41:02.9930000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9878]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T08:41:06.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?16T04:41:06.500000000Z from ?2025?-?10?-?16T04:41:02.993493200Z.
Time Delta: 3506 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?16T08:41:06.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9879]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:41:06.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 7, FullResume: 701, AverageResume: 711 

Event[9880]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:41:06.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 3097917, SuspendEnd: 3097917 

Event[9881]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:41:06.6770000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 39 to 40.

Reason SxTransition 

BootId: 62 

Event[9882]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:41:07.3820000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 40 to 42.

Reason Unknown 

BootId: 62 

Event[9883]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-16T08:41:07.6870000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?16T04:41:01.589711300Z
Wake Time: ?2025?-?10?-?16T04:41:06.663226500Z

Wake Source: Power Button 

Event[9884]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:41:09.7290000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9885]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:41:09.7600000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9886]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:42:07.5900000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 42 to 43.

Reason SessionUnlock 

BootId: 62 

Event[9887]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:43:35.0420000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 43 to 45.

Reason SxTransition 

BootId: 62 

Event[9888]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:43:35.4000000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9889]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:43:36.9560000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9890]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T08:43:40.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?16T04:43:40.500000000Z from ?2025?-?10?-?16T04:43:36.956342400Z.
Time Delta: 3543 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?16T08:43:40.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9891]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:43:40.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 8, FullResume: 695, AverageResume: 709 

Event[9892]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:43:40.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 3248280, SuspendEnd: 3248280 

Event[9893]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:43:40.6750000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 45 to 46.

Reason SxTransition 

BootId: 62 

Event[9894]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:43:41.4710000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 46 to 48.

Reason Unknown 

BootId: 62 

Event[9895]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-16T08:43:41.6930000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?16T04:43:35.027589800Z
Wake Time: ?2025?-?10?-?16T04:43:40.666474500Z

Wake Source: Power Button 

Event[9896]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:43:43.7640000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9897]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:43:43.8010000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9898]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:44:41.6550000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 48 to 49.

Reason SessionUnlock 

BootId: 62 

Event[9899]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:46:08.5520000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 49 to 51.

Reason SxTransition 

BootId: 62 

Event[9900]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:46:08.8800000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9901]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:46:10.4190000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9902]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T08:46:13.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?16T04:46:13.500000000Z from ?2025?-?10?-?16T04:46:10.419609000Z.
Time Delta: 3080 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?16T08:46:13.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9903]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:46:13.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 9, FullResume: 715, AverageResume: 709 

Event[9904]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:46:13.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 3398107, SuspendEnd: 3398108 

Event[9905]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:46:13.6800000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 51 to 52.

Reason SxTransition 

BootId: 62 

Event[9906]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:46:14.3670000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 52 to 54.

Reason Unknown 

BootId: 62 

Event[9907]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-16T08:46:14.6970000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?16T04:46:08.539910200Z
Wake Time: ?2025?-?10?-?16T04:46:13.678581400Z

Wake Source: Power Button 

Event[9908]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:46:16.9290000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9909]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:46:16.9690000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9910]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:47:13.7240000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 54 to 55.

Reason SessionUnlock 

BootId: 62 

Event[9911]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:48:41.6830000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 55 to 57.

Reason SxTransition 

BootId: 62 

Event[9912]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:48:42.0080000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9913]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:48:43.5000000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9914]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T08:48:47.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?16T04:48:47.500000000Z from ?2025?-?10?-?16T04:48:43.500373500Z.
Time Delta: 3999 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?16T08:48:47.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9915]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:48:47.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 10, FullResume: 700, AverageResume: 708 

Event[9916]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:48:47.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 3548014, SuspendEnd: 3548015 

Event[9917]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:48:47.6800000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 57 to 58.

Reason SxTransition 

BootId: 62 

Event[9918]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:48:48.3990000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 58 to 60.

Reason Unknown 

BootId: 62 

Event[9919]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-16T08:48:48.7040000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?16T04:48:41.670406500Z
Wake Time: ?2025?-?10?-?16T04:48:47.669971900Z

Wake Source: Power Button 

Event[9920]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:48:50.9070000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9921]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:48:50.9480000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9922]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:49:48.5840000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 60 to 61.

Reason SessionUnlock 

BootId: 62 

Event[9923]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:51:15.7310000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 61 to 63.

Reason SxTransition 

BootId: 62 

Event[9924]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:51:16.0570000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9925]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:51:17.1730000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9926]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T08:51:20.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?16T04:51:20.500000000Z from ?2025?-?10?-?16T04:51:17.173025300Z.
Time Delta: 3326 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?16T08:51:20.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9927]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:51:20.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 11, FullResume: 687, AverageResume: 706 

Event[9928]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:51:20.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 3697594, SuspendEnd: 3697595 

Event[9929]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:51:20.6780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 63 to 64.

Reason SxTransition 

BootId: 62 

Event[9930]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:51:21.4140000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 64 to 66.

Reason Unknown 

BootId: 62 

Event[9931]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-16T08:51:21.6970000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?16T04:51:15.719851500Z
Wake Time: ?2025?-?10?-?16T04:51:20.668618800Z

Wake Source: Power Button 

Event[9932]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:51:23.9720000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9933]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:51:24.0120000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9934]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:52:21.6750000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 66 to 67.

Reason SessionUnlock 

BootId: 62 

Event[9935]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:53:48.9550000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 67 to 69.

Reason SxTransition 

BootId: 62 

Event[9936]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:53:49.2840000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9937]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:53:50.3060000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9938]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T08:53:54.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?16T04:53:54.500000000Z from ?2025?-?10?-?16T04:53:50.306510900Z.
Time Delta: 4193 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?16T08:53:54.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9939]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:53:54.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 12, FullResume: 817, AverageResume: 716 

Event[9940]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:53:54.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 3847307, SuspendEnd: 3847307 

Event[9941]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:53:54.6790000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 69 to 70.

Reason SxTransition 

BootId: 62 

Event[9942]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:53:55.4520000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 70 to 72.

Reason Unknown 

BootId: 62 

Event[9943]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-16T08:53:55.6940000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?16T04:53:48.943333100Z
Wake Time: ?2025?-?10?-?16T04:53:54.672597300Z

Wake Source: Power Button 

Event[9944]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:53:57.9670000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9945]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:53:57.9960000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9946]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:54:55.6750000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 72 to 73.

Reason SessionUnlock 

BootId: 62 

Event[9947]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:56:23.2510000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 73 to 75.

Reason SxTransition 

BootId: 62 

Event[9948]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:56:23.6520000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9949]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:56:25.1520000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9950]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T08:56:28.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?16T04:56:28.500000000Z from ?2025?-?10?-?16T04:56:25.152538200Z.
Time Delta: 3347 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?16T08:56:28.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9951]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:56:28.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 13, FullResume: 700, AverageResume: 714 

Event[9952]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:56:28.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 3997866, SuspendEnd: 3997866 

Event[9953]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:56:28.6760000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 75 to 76.

Reason SxTransition 

BootId: 62 

Event[9954]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:56:29.3790000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 76 to 78.

Reason Unknown 

BootId: 62 

Event[9955]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-16T08:56:29.6820000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?16T04:56:23.240304200Z
Wake Time: ?2025?-?10?-?16T04:56:28.664473800Z

Wake Source: Power Button 

Event[9956]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:56:31.9000000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9957]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:56:31.9330000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9958]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:57:29.5260000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 78 to 79.

Reason SessionUnlock 

BootId: 62 

Event[9959]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:58:56.5050000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 79 to 81.

Reason SxTransition 

BootId: 62 

Event[9960]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:58:56.8570000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9961]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:58:58.3690000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9962]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T08:59:01.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?16T04:59:01.500000000Z from ?2025?-?10?-?16T04:58:58.369546800Z.
Time Delta: 3130 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?16T08:59:01.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9963]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:59:01.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 14, FullResume: 685, AverageResume: 712 

Event[9964]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:59:01.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 4147643, SuspendEnd: 4147644 

Event[9965]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:59:01.6830000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 81 to 82.

Reason SxTransition 

BootId: 62 

Event[9966]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T08:59:02.3870000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 82 to 84.

Reason Unknown 

BootId: 62 

Event[9967]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-16T08:59:02.7220000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?16T04:58:56.492923300Z
Wake Time: ?2025?-?10?-?16T04:59:01.671412000Z

Wake Source: Power Button 

Event[9968]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:59:04.9180000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9969]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T08:59:04.9580000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9970]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T09:00:02.5100000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 84 to 85.

Reason SessionUnlock 

BootId: 62 

Event[9971]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T09:01:29.7170000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 85 to 87.

Reason SxTransition 

BootId: 62 

Event[9972]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T09:01:30.0710000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9973]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T09:01:31.0860000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9974]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T09:01:34.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?16T05:01:34.500000000Z from ?2025?-?10?-?16T05:01:31.085960300Z.
Time Delta: 3414 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?16T09:01:34.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9975]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T09:01:34.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 15, FullResume: 697, AverageResume: 711 

Event[9976]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T09:01:34.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 4297136, SuspendEnd: 4297136 

Event[9977]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T09:01:34.6780000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 87 to 88.

Reason SxTransition 

BootId: 62 

Event[9978]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T09:01:35.3680000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 88 to 90.

Reason Unknown 

BootId: 62 

Event[9979]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-16T09:01:35.6960000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?16T05:01:29.704379300Z
Wake Time: ?2025?-?10?-?16T05:01:34.666618500Z

Wake Source: Power Button 

Event[9980]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T09:01:37.9310000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9981]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T09:01:37.9680000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[9982]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-16T09:20:46.9920000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[9983]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T09:45:12.5000000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\DropboxInc.Dropbox_wkt425jdc3sga\SystemAppData\Helium\User.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[9984]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T09:45:12.5070000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\DropboxInc.Dropbox_wkt425jdc3sga\SystemAppData\Helium\UserClasses.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[9985]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T09:45:12.5140000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\ProgramData\Packages\DropboxInc.Dropbox_wkt425jdc3sga\S-1-5-21-1511219319-3122627625-3827747853-1001\SystemAppData\Helium\Cache\c98cfc48fb3f1f32_COM15.dat was cleared updating 1 keys and creating 1 modified pages. 

Event[9986]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T09:55:05.7070000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 90 to 91.

Reason SessionUnlock 

BootId: 62 

Event[9987]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-16T09:56:02.5310000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[9988]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-16T09:56:02.6940000Z
  Event ID: 37
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->40.81.94.65:123). 

Event[9989]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T09:56:33.0510000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 91 to 93.

Reason SxTransition 

BootId: 62 

Event[9990]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T09:56:33.6730000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[9991]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T09:56:34.8950000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[9992]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T09:56:38.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?16T05:56:38.500000000Z from ?2025?-?10?-?16T05:56:34.895824900Z.
Time Delta: 3604 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?16T09:56:38.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[9993]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T09:56:38.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 16, FullResume: 712, AverageResume: 711 

Event[9994]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T09:56:38.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 7595208, SuspendEnd: 7595209 

Event[9995]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T09:56:38.6790000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 93 to 94.

Reason SxTransition 

BootId: 62 

Event[9996]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T09:56:39.3970000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 94 to 96.

Reason Unknown 

BootId: 62 

Event[9997]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-16T09:56:39.6960000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?16T05:56:33.039734400Z
Wake Time: ?2025?-?10?-?16T05:56:38.667567700Z

Wake Source: Power Button 

Event[9998]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T09:56:41.7080000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[9999]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T09:56:41.7420000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[10000]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T09:57:39.6900000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 96 to 97.

Reason SessionUnlock 

BootId: 62 

Event[10001]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T09:59:06.6410000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 97 to 99.

Reason SxTransition 

BootId: 62 

Event[10002]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T09:59:06.9890000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[10003]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T09:59:08.0720000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[10004]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T09:59:11.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?16T05:59:11.500000000Z from ?2025?-?10?-?16T05:59:08.072382000Z.
Time Delta: 3427 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?16T09:59:11.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[10005]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T09:59:11.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 17, FullResume: 702, AverageResume: 711 

Event[10006]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T09:59:11.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 7744689, SuspendEnd: 7744690 

Event[10007]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T09:59:11.6770000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 99 to 100.

Reason SxTransition 

BootId: 62 

Event[10008]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T09:59:12.4010000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 100 to 102.

Reason Unknown 

BootId: 62 

Event[10009]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-16T09:59:12.6930000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?16T05:59:06.629613800Z
Wake Time: ?2025?-?10?-?16T05:59:11.670762300Z

Wake Source: Power Button 

Event[10010]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T09:59:14.9190000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[10011]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T09:59:14.9520000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[10012]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:00:11.7430000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 102 to 103.

Reason SessionUnlock 

BootId: 62 

Event[10013]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:01:40.0750000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 103 to 105.

Reason SxTransition 

BootId: 62 

Event[10014]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:01:40.3850000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[10015]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:01:41.9710000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[10016]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T10:01:46.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?16T06:01:46.500000000Z from ?2025?-?10?-?16T06:01:41.971290200Z.
Time Delta: 4528 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?16T10:01:46.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[10017]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:01:46.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 18, FullResume: 723, AverageResume: 711 

Event[10018]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:01:46.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 7895067, SuspendEnd: 7895067 

Event[10019]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:01:46.6800000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 105 to 106.

Reason SxTransition 

BootId: 62 

Event[10020]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:01:47.3840000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 106 to 108.

Reason Unknown 

BootId: 62 

Event[10021]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-16T10:01:47.6990000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?16T06:01:40.063486800Z
Wake Time: ?2025?-?10?-?16T06:01:46.668521200Z

Wake Source: Power Button 

Event[10022]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T10:01:49.7380000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[10023]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T10:01:49.7700000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[10024]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-16T10:02:02.6730000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[10025]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:02:46.7280000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 108 to 109.

Reason SessionUnlock 

BootId: 62 

Event[10026]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:04:14.6120000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 109 to 111.

Reason SxTransition 

BootId: 62 

Event[10027]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:04:14.9340000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[10028]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:04:15.9980000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[10029]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T10:04:19.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?16T06:04:19.500000000Z from ?2025?-?10?-?16T06:04:15.998673000Z.
Time Delta: 3501 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?16T10:04:19.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[10030]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:04:19.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 19, FullResume: 722, AverageResume: 712 

Event[10031]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:04:19.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 8044472, SuspendEnd: 8044473 

Event[10032]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:04:19.6770000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 111 to 112.

Reason SxTransition 

BootId: 62 

Event[10033]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:04:20.3930000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 112 to 114.

Reason Unknown 

BootId: 62 

Event[10034]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-16T10:04:20.6960000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?16T06:04:14.601519200Z
Wake Time: ?2025?-?10?-?16T06:04:19.666409900Z

Wake Source: Power Button 

Event[10035]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T10:04:22.7320000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[10036]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T10:04:22.7650000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[10037]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:05:19.8290000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 114 to 115.

Reason SessionUnlock 

BootId: 62 

Event[10038]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:06:48.1370000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 115 to 117.

Reason SxTransition 

BootId: 62 

Event[10039]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:06:48.4660000Z
  Event ID: 42
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system is entering sleep.

Sleep Reason: System Idle 

Event[10040]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:06:49.5560000Z
  Event ID: 107
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system has resumed from sleep. 

Event[10041]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T10:06:52.5000000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: Time, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The system time has changed to ?2025?-?10?-?16T06:06:52.500000000Z from ?2025?-?10?-?16T06:06:49.556108600Z.
Time Delta: 2943 ms

Change Reason: System time synchronized with the hardware clock.
Process: '' (PID 4).

RTC time: ?2025?-?10?-?16T10:06:52.500000000Z
Current time zone bias: -240
RTC time is in UTC: false
System time was based on RTC time: false 

Event[10042]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:06:52.5000000Z
  Event ID: 131
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. ResumeCount: 20, FullResume: 693, AverageResume: 711 

Event[10043]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:06:52.5000000Z
  Event ID: 130
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Firmware S3 times. SuspendStart: 8194435, SuspendEnd: 8194435 

Event[10044]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:06:52.6800000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 117 to 118.

Reason SxTransition 

BootId: 62 

Event[10045]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:06:53.4590000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 118 to 120.

Reason Unknown 

BootId: 62 

Event[10046]
  Log Name: System
  Source: Microsoft-Windows-Power-Troubleshooter
  Date: 2025-10-16T10:06:53.6970000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The system has returned from a low power state.

Sleep Time: ?2025?-?10?-?16T06:06:48.121229900Z
Wake Time: ?2025?-?10?-?16T06:06:52.667776000Z

Wake Source: Power Button 

Event[10047]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T10:06:55.8210000Z
  Event ID: 18
  Task: None 
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
Windows cannot store Bluetooth authentication codes (link keys) on the local adapter. Bluetooth keyboards might not work in the system BIOS during startup. 

Event[10048]
  Log Name: System
  Source: BTHUSB
  Date: 2025-10-16T10:06:55.8610000Z
  Event ID: 34
  Task: None 
  Level: Warning 
  Opcode: N/A
  Keyword: Classic, 
  User: N/A
  User Name: N/A
  Computer: 256GB-SSD
  Description: 
The local adapter does not support an important Low Energy controller state to support peripheral mode.  The minimum required supported state mask is 0x2491f7fffff, got 0x1fffffff.  Low Energy peripheral role functionality will not be available. 

Event[10049]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-16T10:07:08.6580000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[10050]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:07:52.7540000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 120 to 121.

Reason SessionUnlock 

BootId: 62 

Event[10051]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:08:27.4340000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 121 to 123.

Reason InputHid 

BootId: 62 

Event[10052]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-16T10:24:12.6700000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[10053]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:25:37.7090000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 123 to 124.

Reason SessionUnlock 

BootId: 62 

Event[10054]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:26:03.1450000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 124 to 126.

Reason InputHid 

BootId: 62 

Event[10055]
  Log Name: System
  Source: Microsoft-Windows-UserModePowerService
  Date: 2025-10-16T10:32:22.5290000Z
  Event ID: 12
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
Process C:\Windows\System32\dllhost.exe (process ID:11500) reset policy scheme from {381b4222-f694-41f0-9685-ff5bb260df2e} to {381b4222-f694-41f0-9685-ff5bb260df2e} 

Event[10056]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-16T10:38:18.5550000Z
  Event ID: 7045
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-21-1511219319-3122627625-3827747853-1001
  User Name: 256GB-SSD\aaron
  Computer: 256GB-SSD
  Description: 
A service was installed in the system.

Service Name:  System Update
Service File Name:  "C:\Program Files (x86)\Lenovo\System Update\SUService.exe"
Service Type:  user mode service
Service Start Type:  demand start
Service Account:  LocalSystem 

Event[10057]
  Log Name: System
  Source: Microsoft-Windows-Configuration-Change-Monitor
  Date: 2025-10-16T10:38:19.9980000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
N/A

Event[10058]
  Log Name: System
  Source: Microsoft-Windows-Configuration-Change-Monitor
  Date: 2025-10-16T10:38:20.1220000Z
  Event ID: 1
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
N/A

Event[10059]
  Log Name: System
  Source: Microsoft-Windows-DNS-Client
  Date: 2025-10-16T10:38:42.9760000Z
  Event ID: 1014
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-20
  User Name: NT AUTHORITY\NETWORK SERVICE
  Computer: 256GB-SSD
  Description: 
Name resolution for the name t-s2-ring.msedge.net timed out after none of the configured DNS servers responded. Client PID 8976. 

Event[10060]
  Log Name: System
  Source: Microsoft-Windows-Time-Service
  Date: 2025-10-16T10:41:16.6830000Z
  Event ID: 158
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
The time provider 'VMICTimeProvider' has indicated that the current hardware and operating environment is not supported and has stopped. This behavior is expected for VMICTimeProvider on non-HyperV-guest environments. This may be the expected behavior for the current provider in the current operating environment as well. 

Event[10061]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:55:57.9890000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 126 to 127.

Reason SessionUnlock 

BootId: 62 

Event[10062]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T10:57:15.3430000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 127 to 129.

Reason InputHid 

BootId: 62 

Event[10063]
  Log Name: System
  Source: Microsoft-Windows-EnhancedPhishingProtection-Events
  Date: 2025-10-16T11:01:45.8300000Z
  Event ID: 8265
  Task: N/A
  Level: Warning 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-19
  User Name: NT AUTHORITY\LOCAL SERVICE
  Computer: 256GB-SSD
  Description: 
Aggregated Threat assessment of current system instance 

Event[10064]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-16T11:08:56.9270000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from demand start to auto start. 

Event[10065]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-16T11:11:42.7000000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from auto start to demand start. 

Event[10066]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-16T11:11:44.7130000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from demand start to auto start. 

Event[10067]
  Log Name: System
  Source: Service Control Manager
  Date: 2025-10-16T11:14:23.7310000Z
  Event ID: 7040
  Task: N/A
  Level: Information 
  Opcode: N/A
  Keyword: Classic, 
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The start type of the Windows Modules Installer service was changed from auto start to demand start. 

Event[10068]
  Log Name: System
  Source: Microsoft-Windows-Kernel-General
  Date: 2025-10-16T11:14:59.9920000Z
  Event ID: 16
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The access history in hive \??\C:\Users\aaron\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 2 keys and creating 1 modified pages. 

Event[10069]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T11:17:23.9740000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 129 to 130.

Reason SessionUnlock 

BootId: 62 

Event[10070]
  Log Name: System
  Source: Microsoft-Windows-Kernel-Power
  Date: 2025-10-16T11:17:33.5580000Z
  Event ID: 566
  Task: N/A
  Level: Information 
  Opcode: Info  
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: 256GB-SSD
  Description: 
The system session has transitioned from 130 to 132.

Reason InputHid 

BootId: 62 

