_raw:
11/18/2025 12:46:44.705 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=469
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-18T09:08:08Z
 	Last quick scan end time: 2025-11-18T09:09:36Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 12:45:52.729 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=472
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-18T08:34:52Z
 	Last quick scan end time: 2025-11-18T08:36:12Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000

_sourcetype: XmlWinEventLog

sourcetype: XmlWinEventLog


_raw:
11/18/2025 12:45:37.050 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=476
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-18T08:14:18Z
 	Last quick scan end time: 2025-11-18T08:15:44Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 12:43:48.018 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=475
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-18T09:34:04Z
 	Last quick scan end time: 2025-11-18T09:35:41Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 12:42:00.115 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=475
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-18T09:25:39Z
 	Last quick scan end time: 2025-11-18T09:27:07Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 12:40:31.299 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=472
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-18T08:58:36Z
 	Last quick scan end time: 2025-11-18T09:00:07Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 12:39:42.505 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=470
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-18T09:16:39Z
 	Last quick scan end time: 2025-11-18T09:18:02Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 12:23:09.287 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=474
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 1
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-17T15:33:39Z
 	Last quick scan end time: 2025-11-17T15:35:10Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 12:21:39.672 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=467
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-18T09:54:06Z
 	Last quick scan end time: 2025-11-18T09:55:40Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 12:17:07.189 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=461
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 2
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-16T09:25:54Z
 	Last quick scan end time: 2025-11-16T09:26:21Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 11:46:44.700 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=468
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-18T09:08:08Z
 	Last quick scan end time: 2025-11-18T09:09:36Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 11:45:52.717 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=471
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-18T08:34:52Z
 	Last quick scan end time: 2025-11-18T08:36:12Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 11:45:37.018 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=475
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-18T08:14:18Z
 	Last quick scan end time: 2025-11-18T08:15:44Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 11:43:47.994 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=474
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-18T09:34:04Z
 	Last quick scan end time: 2025-11-18T09:35:41Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 11:42:00.122 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=474
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-18T09:25:39Z
 	Last quick scan end time: 2025-11-18T09:27:07Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 11:40:31.280 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=471
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-18T08:58:36Z
 	Last quick scan end time: 2025-11-18T09:00:07Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 11:39:42.508 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=469
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-18T09:16:39Z
 	Last quick scan end time: 2025-11-18T09:18:02Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 11:23:09.274 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=473
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 1
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-17T15:33:39Z
 	Last quick scan end time: 2025-11-17T15:35:10Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 11:21:39.628 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=466
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-18T09:54:06Z
 	Last quick scan end time: 2025-11-18T09:55:40Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 11:17:07.279 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=460
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 2
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-16T09:25:54Z
 	Last quick scan end time: 2025-11-16T09:26:21Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 10:46:44.709 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=467
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-18T09:08:08Z
 	Last quick scan end time: 2025-11-18T09:09:36Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 10:45:52.719 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=470
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-18T08:34:52Z
 	Last quick scan end time: 2025-11-18T08:36:12Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 10:45:37.023 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=474
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-18T08:14:18Z
 	Last quick scan end time: 2025-11-18T08:15:44Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 10:43:48.022 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=473
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-18T09:34:04Z
 	Last quick scan end time: 2025-11-18T09:35:41Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 10:42:00.165 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=473
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-18T09:25:39Z
 	Last quick scan end time: 2025-11-18T09:27:07Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 10:40:31.285 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=470
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-18T08:58:36Z
 	Last quick scan end time: 2025-11-18T09:00:07Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 10:39:42.543 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=468
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-18T09:16:39Z
 	Last quick scan end time: 2025-11-18T09:18:02Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 10:23:09.252 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=472
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-17T15:33:39Z
 	Last quick scan end time: 2025-11-17T15:35:10Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 10:21:39.633 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=465
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-18T09:54:06Z
 	Last quick scan end time: 2025-11-18T09:55:40Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 10:17:07.157 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=459
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25100.9008
 	Engine version: 1.1.25100.9002
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.441.315.0
 	Antispyware security intelligence version: 1.441.315.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 2
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-11-18T09:59:26Z
 	Antispyware security intelligence creation time: 2025-11-18T09:59:26Z
 	Last quick scan start time: 2025-11-16T09:25:54Z
 	Last quick scan end time: 2025-11-16T09:26:21Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
11/18/2025 09:56:57.154 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=466
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x62B4C130
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x4A13D4F9


_raw:
11/18/2025 09:56:57.153 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=465
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/18/2025 09:56:56.672 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=464
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.441.315.0
 	Previous security intelligence Version: 1.441.286.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.25100.9002


_raw:
11/18/2025 09:56:56.672 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=463
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.441.315.0
 	Previous security intelligence Version: 1.441.286.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.25100.9002


_raw:
11/18/2025 09:56:10.262 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=473
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x62B4C130
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x4A13D4F9


_raw:
11/18/2025 09:56:10.260 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=472
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/18/2025 09:56:09.782 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=471
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.441.315.0
 	Previous security intelligence Version: 1.441.286.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.25100.9002


_raw:
11/18/2025 09:56:09.782 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=470
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.441.315.0
 	Previous security intelligence Version: 1.441.286.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.25100.9002


_raw:
11/18/2025 09:56:05.501 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=469
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x62B4C130
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x4A13D4F9


_raw:
11/18/2025 09:56:05.500 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=468
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/18/2025 09:56:05.029 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=467
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.441.315.0
 	Previous security intelligence Version: 1.441.286.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.25100.9002


_raw:
11/18/2025 09:56:05.028 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=466
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.441.315.0
 	Previous security intelligence Version: 1.441.286.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.25100.9002


_raw:
11/18/2025 09:54:00.670 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=472
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x62B4C130
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x4A13D4F9


_raw:
11/18/2025 09:54:00.669 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=471
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/18/2025 09:54:00.196 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=470
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.441.315.0
 	Previous security intelligence Version: 1.441.286.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.25100.9002


_raw:
11/18/2025 09:54:00.195 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=469
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.441.315.0
 	Previous security intelligence Version: 1.441.286.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.25100.9002


_raw:
11/18/2025 09:52:13.608 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=472
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x62B4C130
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x4A13D4F9


_raw:
11/18/2025 09:52:13.607 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=471
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/18/2025 09:52:13.145 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=470
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.441.315.0
 	Previous security intelligence Version: 1.441.286.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.25100.9002


_raw:
11/18/2025 09:52:13.144 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=469
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.441.315.0
 	Previous security intelligence Version: 1.441.286.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.25100.9002


_raw:
11/18/2025 09:52:09.425 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=467
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x62B4C130
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x4A13D4F9


_raw:
11/18/2025 09:52:09.424 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=466
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/18/2025 09:52:08.961 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=465
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.441.315.0
 	Previous security intelligence Version: 1.441.286.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.25100.9002


_raw:
11/18/2025 09:52:08.960 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=464
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.441.315.0
 	Previous security intelligence Version: 1.441.286.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.25100.9002


_raw:
11/18/2025 09:50:43.606 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=469
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x62B4C130
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x4A13D4F9


_raw:
11/18/2025 09:50:43.605 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=468
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
11/18/2025 09:50:43.143 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=467
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.441.315.0
 	Previous security intelligence Version: 1.441.286.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.25100.9002


_raw:
11/18/2025 09:50:43.142 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=466
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.441.315.0
 	Previous security intelligence Version: 1.441.286.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25100.9002
 	Previous Engine Version: 1.1.25100.9002


_raw:
11/18/2025 09:46:45.168 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=462
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\131 = 0x0
 	New value:


_raw:
11/18/2025 09:46:45.168 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=461
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\217 = 0x3


_raw:
11/18/2025 09:46:45.166 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=460
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = LoadingEngine
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = ServiceStartedSuccessfully


_raw:
11/18/2025 09:46:45.165 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=459
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x10CA4078
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x62B4C130


_raw:
11/18/2025 09:46:45.163 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=458
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\InstallLocation = C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\InstallLocation = C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\


_raw:
11/18/2025 09:46:37.787 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=457
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = ClientInitAsimov
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = LoadingEngine


_raw:
11/18/2025 09:46:37.787 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=456
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/18/2025 09:46:37.272 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=455
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = PostPlatformUpdate
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = ClientInitAsimov


_raw:
11/18/2025 09:46:36.327 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2014
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=454
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus platform update to 4.18.25100.9008 has succeeded.


_raw:
11/18/2025 09:46:36.225 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5017
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=453
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus service feature has encountered an error and failed.
 	Feature: MDE AV Configurations
  	Failure Reason: Group Policy hive was not ready when MDE AV service started and AV configurations might be not as expected.
 	Recommended Mitigation: Investigate recent changes in Group Policy server settings and reboot the device.
 	Error Code: 0x80070002
 	Error description: The system cannot find the file specified.


_raw:
11/18/2025 09:46:34.076 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5017
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=452
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus service feature has encountered an error and failed.
 	Feature: MDE AV Configurations
  	Failure Reason: Group Policy hive was not ready when MDE AV service started and AV configurations might be not as expected.
 	Recommended Mitigation: Investigate recent changes in Group Policy server settings and reboot the device.
 	Error Code: 0x80070002
 	Error description: The system cannot find the file specified.


_raw:
11/18/2025 09:46:33.457 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=451
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: N/A\Diagnostics\CleanupComponentProgress =
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\CleanupComponentProgress = CleanupEngine


_raw:
11/18/2025 09:45:53.179 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=465
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\131 = 0x0
 	New value:


_raw:
11/18/2025 09:45:53.179 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=464
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\217 = 0x3


_raw:
11/18/2025 09:45:53.177 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=463
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = LoadingEngine
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = ServiceStartedSuccessfully


_raw:
11/18/2025 09:45:53.177 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=462
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x10CA4078
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x62B4C130


_raw:
11/18/2025 09:45:53.176 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=461
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\InstallLocation = C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\InstallLocation = C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\


_raw:
11/18/2025 09:45:46.112 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=460
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = InitPluginModules
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = LoadingEngine


_raw:
11/18/2025 09:45:45.597 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=459
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = PostPlatformUpdate
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = InitPluginModules


_raw:
11/18/2025 09:45:45.596 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=458
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/18/2025 09:45:45.082 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=457
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = InitializeMiscConfigLibrary
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = PostPlatformUpdate


_raw:
11/18/2025 09:45:45.081 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=456
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/18/2025 09:45:44.670 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2014
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=455
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus platform update to 4.18.25100.9008 has succeeded.


_raw:
11/18/2025 09:45:44.590 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5017
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=454
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus service feature has encountered an error and failed.
 	Feature: MDE AV Configurations
  	Failure Reason: Group Policy hive was not ready when MDE AV service started and AV configurations might be not as expected.
 	Recommended Mitigation: Investigate recent changes in Group Policy server settings and reboot the device.
 	Error Code: 0x80070002
 	Error description: The system cannot find the file specified.


_raw:
11/18/2025 09:45:42.601 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5017
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=453
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus service feature has encountered an error and failed.
 	Feature: MDE AV Configurations
  	Failure Reason: Group Policy hive was not ready when MDE AV service started and AV configurations might be not as expected.
 	Recommended Mitigation: Investigate recent changes in Group Policy server settings and reboot the device.
 	Error Code: 0x80070002
 	Error description: The system cannot find the file specified.


_raw:
11/18/2025 09:45:41.907 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=452
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: N/A\Diagnostics\CleanupComponentProgress =
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\CleanupComponentProgress = CleanupEngine


_raw:
11/18/2025 09:45:37.408 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=469
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\131 = 0x0
 	New value:


_raw:
11/18/2025 09:45:37.408 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=468
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\217 = 0x3


_raw:
11/18/2025 09:45:37.406 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=467
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = LoadingEngine
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = ServiceStartedSuccessfully


_raw:
11/18/2025 09:45:37.406 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=466
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x10CA4078
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x62B4C130


_raw:
11/18/2025 09:45:37.405 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=465
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\InstallLocation = C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\InstallLocation = C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\


_raw:
11/18/2025 09:45:30.106 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=464
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = InitPluginModules
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = LoadingEngine


_raw:
11/18/2025 09:45:29.574 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=463
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = PostPlatformUpdate
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = InitPluginModules


_raw:
11/18/2025 09:45:29.573 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=462
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/18/2025 09:45:29.076 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=461
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = InitializeMiscConfigLibrary
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = PostPlatformUpdate


_raw:
11/18/2025 09:45:29.074 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=460
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/18/2025 09:45:28.675 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2014
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=459
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus platform update to 4.18.25100.9008 has succeeded.


_raw:
11/18/2025 09:45:28.596 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5017
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=458
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus service feature has encountered an error and failed.
 	Feature: MDE AV Configurations
  	Failure Reason: Group Policy hive was not ready when MDE AV service started and AV configurations might be not as expected.
 	Recommended Mitigation: Investigate recent changes in Group Policy server settings and reboot the device.
 	Error Code: 0x80070002
 	Error description: The system cannot find the file specified.


_raw:
11/18/2025 09:45:27.183 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=457
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = InitializeMiscConfigLibrary
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = PostPlatformUpdate


_raw:
11/18/2025 09:45:27.183 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=456
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
11/18/2025 09:45:26.701 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5017
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=455
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus service feature has encountered an error and failed.
 	Feature: MDE AV Configurations
  	Failure Reason: Group Policy hive was not ready when MDE AV service started and AV configurations might be not as expected.
 	Recommended Mitigation: Investigate recent changes in Group Policy server settings and reboot the device.
 	Error Code: 0x80070002
 	Error description: The system cannot find the file specified.


_raw:
11/18/2025 09:45:26.199 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=454
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: N/A\Diagnostics\CleanupComponentProgress =
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\CleanupComponentProgress = CleanupEngine


_raw:
11/18/2025 09:43:48.443 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=468
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\131 = 0x0
 	New value:


_raw:
11/18/2025 09:43:48.443 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=467
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\217 = 0x3


_raw:
11/18/2025 09:43:48.441 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=466
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = LoadingEngine
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = ServiceStartedSuccessfully


_raw:
11/18/2025 09:43:48.441 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=465
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x10CA4078
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x62B4C130


_raw:
11/18/2025 09:43:48.440 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=464
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\InstallLocation = C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\InstallLocation = C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\


_raw:
11/18/2025 09:43:40.735 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=463
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = InitSpynetManager
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = LoadingEngine


_raw:
11/18/2025 09:43:40.221 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=462
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = PostPlatformUpdate
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = InitSpynetManager


_raw:
11/18/2025 09:43:40.220 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=461
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
11/18/2025 09:43:39.280 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2014
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=460
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus platform update to 4.18.25100.9008 has succeeded.


_raw:
11/18/2025 09:43:39.192 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5017
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=459
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus service feature has encountered an error and failed.
 	Feature: MDE AV Configurations
  	Failure Reason: Group Policy hive was not ready when MDE AV service started and AV configurations might be not as expected.
 	Recommended Mitigation: Investigate recent changes in Group Policy server settings and reboot the device.
 	Error Code: 0x80070002
 	Error description: The system cannot find the file specified.


_raw:
11/18/2025 09:43:37.152 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5017
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=458
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus service feature has encountered an error and failed.
 	Feature: MDE AV Configurations
  	Failure Reason: Group Policy hive was not ready when MDE AV service started and AV configurations might be not as expected.
 	Recommended Mitigation: Investigate recent changes in Group Policy server settings and reboot the device.
 	Error Code: 0x80070002
 	Error description: The system cannot find the file specified.


_raw:
11/18/2025 09:43:36.531 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=457
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: N/A\Diagnostics\CleanupComponentProgress =
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\CleanupComponentProgress = CleanupEngine


_raw:
11/18/2025 09:42:00.590 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=468
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\131 = 0x0
 	New value:


_raw:
11/18/2025 09:42:00.590 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=467
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\217 = 0x3


_raw:
11/18/2025 09:42:00.588 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=466
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = LoadingEngine
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = ServiceStartedSuccessfully


_raw:
11/18/2025 09:42:00.588 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=465
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x10CA4078
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x62B4C130


_raw:
11/18/2025 09:42:00.587 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=464
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\InstallLocation = C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25090.3009-0\
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\InstallLocation = C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\


_raw:
11/18/2025 09:41:53.410 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=463
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = VerifyLicense
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = LoadingEngine