2015-04-03T18:59:05.4291548 test\a true <QueryList><Query Id="0" Path="System"><Select Path="System">*[System[Provider[@Name='Microsoft-Windows-Winlogon'] and EventID=7002]]</Select></Query></QueryList> true test\a S4U LeastPrivilege IgnoreNew false true true false false true false true true false false false P3D 7 C:\Users\a\Desktop\a.exe