_raw:
12/11/2025 01:54:35.070 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1189
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T10:30:17Z
 	Last quick scan end time: 2025-12-11T10:31:48Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 01:52:23.424 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1186
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T09:21:19Z
 	Last quick scan end time: 2025-12-11T09:22:39Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000

_sourcetype: XmlWinEventLog

sourcetype: XmlWinEventLog


_raw:
12/11/2025 01:51:31.698 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1187
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T08:55:26Z
 	Last quick scan end time: 2025-12-11T08:56:52Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 01:50:04.703 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1179
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T10:19:25Z
 	Last quick scan end time: 2025-12-11T10:20:42Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 01:33:39.704 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1170
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 1
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-10T16:43:43Z
 	Last quick scan end time: 2025-12-10T16:45:21Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 01:32:29.873 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1180
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T07:37:24Z
 	Last quick scan end time: 2025-12-11T07:38:55Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 01:27:47.873 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1118
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 11
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-11-30T01:06:00Z
 	Last quick scan end time: 2025-11-30T01:07:41Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 12:57:10.153 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1185
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T09:27:58Z
 	Last quick scan end time: 2025-12-11T09:29:29Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 12:56:22.217 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1187
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T10:25:05Z
 	Last quick scan end time: 2025-12-11T10:26:22Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 12:56:17.523 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1187
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T09:01:30Z
 	Last quick scan end time: 2025-12-11T09:02:53Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 12:54:35.056 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1188
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T10:30:17Z
 	Last quick scan end time: 2025-12-11T10:31:48Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 12:52:23.420 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1185
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T09:21:19Z
 	Last quick scan end time: 2025-12-11T09:22:39Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 12:51:31.667 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1186
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T08:55:26Z
 	Last quick scan end time: 2025-12-11T08:56:52Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 12:50:04.695 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1178
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T10:19:25Z
 	Last quick scan end time: 2025-12-11T10:20:42Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 12:33:39.659 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1169
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 1
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-10T16:43:43Z
 	Last quick scan end time: 2025-12-10T16:45:21Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 12:32:29.858 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1179
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T07:37:24Z
 	Last quick scan end time: 2025-12-11T07:38:55Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 12:27:47.915 PM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1117
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 11
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-11-30T01:06:00Z
 	Last quick scan end time: 2025-11-30T01:07:41Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 11:57:10.157 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1184
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T09:27:58Z
 	Last quick scan end time: 2025-12-11T09:29:29Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 11:56:22.213 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1186
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T10:25:05Z
 	Last quick scan end time: 2025-12-11T10:26:22Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 11:56:17.479 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1186
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T09:01:30Z
 	Last quick scan end time: 2025-12-11T09:02:53Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 11:54:35.038 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1187
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T10:30:17Z
 	Last quick scan end time: 2025-12-11T10:31:48Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 11:52:23.417 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1184
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T09:21:19Z
 	Last quick scan end time: 2025-12-11T09:22:39Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 11:51:31.630 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1185
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T08:55:26Z
 	Last quick scan end time: 2025-12-11T08:56:52Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 11:50:04.695 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1177
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T10:19:25Z
 	Last quick scan end time: 2025-12-11T10:20:42Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 11:33:39.669 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1168
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-10T16:43:43Z
 	Last quick scan end time: 2025-12-10T16:45:21Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 11:32:29.833 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1178
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T07:37:24Z
 	Last quick scan end time: 2025-12-11T07:38:55Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 11:27:47.849 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1116
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 11
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-11-30T01:06:00Z
 	Last quick scan end time: 2025-11-30T01:07:41Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 10:57:10.149 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1183
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T09:27:58Z
 	Last quick scan end time: 2025-12-11T09:29:29Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 10:56:22.187 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1185
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T10:25:05Z
 	Last quick scan end time: 2025-12-11T10:26:22Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 10:56:17.454 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1185
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T09:01:30Z
 	Last quick scan end time: 2025-12-11T09:02:53Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 10:54:35.021 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1186
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T10:30:17Z
 	Last quick scan end time: 2025-12-11T10:31:48Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 10:52:23.426 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1183
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T09:21:19Z
 	Last quick scan end time: 2025-12-11T09:22:39Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 10:51:31.602 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1184
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T08:55:26Z
 	Last quick scan end time: 2025-12-11T08:56:52Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 10:50:04.694 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1176
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T10:19:25Z
 	Last quick scan end time: 2025-12-11T10:20:42Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 10:33:39.673 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1167
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-10T16:43:43Z
 	Last quick scan end time: 2025-12-10T16:45:21Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 10:32:29.827 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=Deckhand-02.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1177
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 0
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-12-11T07:37:24Z
 	Last quick scan end time: 2025-12-11T07:38:55Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 10:27:47.879 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1151
EventType=4
ComputerName=APT-DC-01.allports.local
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1115
Keywords=None
TaskCategory=None
OpCode=Info
Message=Endpoint Protection client health report (time in UTC):
 	Platform version: 4.18.25110.5
 	Engine version: 1.1.25110.1
 	Network Realtime Inspection engine version: 0.0.0.0
 	Antivirus security intelligence version: 1.443.38.0
 	Antispyware security intelligence version: 1.443.38.0
 	Network Realtime Inspection security intelligence version: 0.0.0.0
 	RTP state: Disabled
 	OA state: Disabled
 	IOAV state: Disabled
 	BM state: Disabled
 	Antivirus security intelligence age: 0
 	Antispyware security intelligence age: 0
 	Last quick scan age: 11
 	Last full scan age: 4294967295
 	Antivirus security intelligence creation time: 2025-12-11T08:59:40Z
 	Antispyware security intelligence creation time: 2025-12-11T08:59:40Z
 	Last quick scan start time: 2025-11-30T01:06:00Z
 	Last quick scan end time: 2025-11-30T01:07:41Z
 	Last quick scan source: 2
 	Last full scan start time: 1601-01-01T00:00:00Z
 	Last full scan end time: 1601-01-01T00:00:00Z
 	Last full scan source: 0
 	Product status: 0x00080000


_raw:
12/11/2025 10:07:47.728 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1182
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x2171F306
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x3DCF37


_raw:
12/11/2025 10:07:47.727 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1181
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
12/11/2025 10:07:47.261 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1180
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.443.38.0
 	Previous security intelligence Version: 1.443.15.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25110.1
 	Previous Engine Version: 1.1.25110.1


_raw:
12/11/2025 10:07:47.261 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1179
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.443.38.0
 	Previous security intelligence Version: 1.443.15.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25110.1
 	Previous Engine Version: 1.1.25110.1


_raw:
12/11/2025 10:07:11.263 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1013
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1178
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus has removed history of malware and other potentially unwanted software.
 	Time: 2025-11-26T15:07:11Z
 	User: NT AUTHORITY\SYSTEM


_raw:
12/11/2025 10:06:33.306 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1184
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x2171F306
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x3DCF37


_raw:
12/11/2025 10:06:33.305 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1183
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
12/11/2025 10:06:32.842 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1182
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.443.38.0
 	Previous security intelligence Version: 1.443.15.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25110.1
 	Previous Engine Version: 1.1.25110.1


_raw:
12/11/2025 10:06:32.842 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1181
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.443.38.0
 	Previous security intelligence Version: 1.443.15.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25110.1
 	Previous Engine Version: 1.1.25110.1


_raw:
12/11/2025 10:06:29.516 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1184
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x2171F306
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x3DCF37


_raw:
12/11/2025 10:06:29.515 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1183
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
12/11/2025 10:06:29.028 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1182
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.443.38.0
 	Previous security intelligence Version: 1.443.15.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25110.1
 	Previous Engine Version: 1.1.25110.1


_raw:
12/11/2025 10:06:29.028 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1181
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.443.38.0
 	Previous security intelligence Version: 1.443.15.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25110.1
 	Previous Engine Version: 1.1.25110.1


_raw:
12/11/2025 10:06:23.242 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1013
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1180
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus has removed history of malware and other potentially unwanted software.
 	Time: 2025-11-26T15:06:23Z
 	User: NT AUTHORITY\SYSTEM


_raw:
12/11/2025 10:06:18.492 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1013
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1180
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus has removed history of malware and other potentially unwanted software.
 	Time: 2025-11-26T15:06:18Z
 	User: NT AUTHORITY\SYSTEM


_raw:
12/11/2025 10:04:47.632 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1185
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x2171F306
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x3DCF37


_raw:
12/11/2025 10:04:47.631 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1184
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
12/11/2025 10:04:47.161 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1183
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.443.38.0
 	Previous security intelligence Version: 1.443.15.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25110.1
 	Previous Engine Version: 1.1.25110.1


_raw:
12/11/2025 10:04:47.161 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1182
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.443.38.0
 	Previous security intelligence Version: 1.443.15.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25110.1
 	Previous Engine Version: 1.1.25110.1


_raw:
12/11/2025 10:04:36.074 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1013
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win05
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1181
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus has removed history of malware and other potentially unwanted software.
 	Time: 2025-11-26T15:04:36Z
 	User: NT AUTHORITY\SYSTEM


_raw:
12/11/2025 10:02:33.972 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1182
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x2171F306
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x3DCF37


_raw:
12/11/2025 10:02:33.971 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1181
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
12/11/2025 10:02:33.483 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1180
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.443.38.0
 	Previous security intelligence Version: 1.443.15.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25110.1
 	Previous Engine Version: 1.1.25110.1


_raw:
12/11/2025 10:02:33.483 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1179
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.443.38.0
 	Previous security intelligence Version: 1.443.15.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25110.1
 	Previous Engine Version: 1.1.25110.1


_raw:
12/11/2025 10:02:24.494 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1013
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win04
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1178
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus has removed history of malware and other potentially unwanted software.
 	Time: 2025-11-26T15:02:24Z
 	User: NT AUTHORITY\SYSTEM


_raw:
12/11/2025 10:01:59.082 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1183
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x2171F306
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x3DCF37


_raw:
12/11/2025 10:01:59.081 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1182
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
12/11/2025 10:01:58.608 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1181
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.443.38.0
 	Previous security intelligence Version: 1.443.15.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25110.1
 	Previous Engine Version: 1.1.25110.1


_raw:
12/11/2025 10:01:58.607 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1180
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.443.38.0
 	Previous security intelligence Version: 1.443.15.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25110.1
 	Previous Engine Version: 1.1.25110.1


_raw:
12/11/2025 10:01:32.640 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1013
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win01
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1179
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus has removed history of malware and other potentially unwanted software.
 	Time: 2025-11-26T15:01:32Z
 	User: NT AUTHORITY\SYSTEM


_raw:
12/11/2025 10:00:28.520 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1175
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x2171F306
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\CoreService\WdConfigHash = 0x3DCF37


_raw:
12/11/2025 10:00:28.519 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1174
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1
 	New value: Default\ServiceStartStates = 0x0


_raw:
12/11/2025 10:00:28.033 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1173
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.443.38.0
 	Previous security intelligence Version: 1.443.15.0
 	Security intelligence Type: AntiSpyware
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25110.1
 	Previous Engine Version: 1.1.25110.1


_raw:
12/11/2025 10:00:28.033 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2000
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1172
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus security intelligence version updated.
 	Current security intelligence Version: 1.443.38.0
 	Previous security intelligence Version: 1.443.15.0
 	Security intelligence Type: AntiVirus
 	Update Type: Delta
 	User: NT AUTHORITY\SYSTEM
 	Current Engine Version: 1.1.25110.1
 	Previous Engine Version: 1.1.25110.1


_raw:
12/11/2025 10:00:05.760 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=1013
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win06
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1171
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus has removed history of malware and other potentially unwanted software.
 	Time: 2025-11-26T15:00:05Z
 	User: NT AUTHORITY\SYSTEM


_raw:
12/11/2025 09:57:10.589 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1177
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\217 = 0x3
 	New value:


_raw:
12/11/2025 09:57:10.589 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1176
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\227 = 0x3


_raw:
12/11/2025 09:57:10.587 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1175
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = LoadingEngine
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = ServiceStartedSuccessfully


_raw:
12/11/2025 09:57:10.586 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1174
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\InstallLocation = C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\InstallLocation = C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25110.5-0\


_raw:
12/11/2025 09:57:02.709 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1173
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = ClientInitAsimov
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = LoadingEngine


_raw:
12/11/2025 09:57:02.708 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1172
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
12/11/2025 09:57:02.208 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1171
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = PostPlatformUpdate
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = ClientInitAsimov


_raw:
12/11/2025 09:57:01.237 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2014
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1170
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus platform update to 4.18.25110.5 has succeeded.


_raw:
12/11/2025 09:57:01.142 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5017
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1169
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus service feature has encountered an error and failed.
 	Feature: MDE AV Configurations
  	Failure Reason: Group Policy hive was not ready when MDE AV service started and AV configurations might be not as expected.
 	Recommended Mitigation: Investigate recent changes in Group Policy server settings and reboot the device.
 	Error Code: 0x80070002
 	Error description: The system cannot find the file specified.


_raw:
12/11/2025 09:56:58.583 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1168
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\Diagnostics\LastKnownGoodPlatformCandidate =
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\LastKnownGoodPlatformCandidate = C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0


_raw:
12/11/2025 09:56:58.583 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1167
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = InitializeMiscConfigLibrary
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = PostPlatformUpdate


_raw:
12/11/2025 09:56:58.582 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1166
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
12/11/2025 09:56:58.107 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5017
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1165
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus service feature has encountered an error and failed.
 	Feature: MDE AV Configurations
  	Failure Reason: Group Policy hive was not ready when MDE AV service started and AV configurations might be not as expected.
 	Recommended Mitigation: Investigate recent changes in Group Policy server settings and reboot the device.
 	Error Code: 0x80070002
 	Error description: The system cannot find the file specified.


_raw:
12/11/2025 09:56:57.630 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1164
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\NIS\Consumers\IPS\DisableBmNetworkSensor = 0x1
 	New value: Default\NIS\Consumers\IPS\DisableBmNetworkSensor = 0x0


_raw:
12/11/2025 09:56:57.629 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1163
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\CleanupComponentProgress = CleanupCompleted
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\CleanupComponentProgress = CleanupEngine


_raw:
12/11/2025 09:56:57.098 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5004
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1162
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Real-time Protection feature configuration has changed.
 	Feature: Network Inspection System
 	Configuration: 1


_raw:
12/11/2025 09:56:57.096 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-OutOfScope
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1161
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\NIS\Consumers\IPS\DisableBmNetworkSensor = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\NIS\Consumers\IPS\DisableBmNetworkSensor = 0x1


_raw:
12/11/2025 09:56:22.660 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1179
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\217 = 0x3
 	New value:


_raw:
12/11/2025 09:56:22.660 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1178
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\227 = 0x3


_raw:
12/11/2025 09:56:22.659 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1177
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = LoadingEngine
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = ServiceStartedSuccessfully


_raw:
12/11/2025 09:56:22.657 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1176
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\InstallLocation = C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\InstallLocation = C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25110.5-0\


_raw:
12/11/2025 09:56:17.888 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1179
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\217 = 0x3
 	New value:


_raw:
12/11/2025 09:56:17.888 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1178
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value:
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\227 = 0x3


_raw:
12/11/2025 09:56:17.887 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1177
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = LoadingEngine
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = ServiceStartedSuccessfully


_raw:
12/11/2025 09:56:17.886 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1176
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\InstallLocation = C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0\
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\InstallLocation = C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25110.5-0\


_raw:
12/11/2025 09:56:15.890 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1175
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = PostPlatformUpdate
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = LoadingEngine


_raw:
12/11/2025 09:56:15.889 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1174
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
12/11/2025 09:56:15.296 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1173
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\LastKnownGoodPlatformCandidate = C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0
 	New value: Default\Diagnostics\LastKnownGoodPlatformCandidate =


_raw:
12/11/2025 09:56:15.296 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1172
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = InitializeMiscConfigLibrary
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = PostPlatformUpdate


_raw:
12/11/2025 09:56:15.295 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1171
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
12/11/2025 09:56:14.890 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=2014
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1170
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus platform update to 4.18.25110.5 has succeeded.


_raw:
12/11/2025 09:56:14.814 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5017
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1169
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus service feature has encountered an error and failed.
 	Feature: MDE AV Configurations
  	Failure Reason: Group Policy hive was not ready when MDE AV service started and AV configurations might be not as expected.
 	Recommended Mitigation: Investigate recent changes in Group Policy server settings and reboot the device.
 	Error Code: 0x80070002
 	Error description: The system cannot find the file specified.


_raw:
12/11/2025 09:56:12.483 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1168
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\Diagnostics\LastKnownGoodPlatformCandidate =
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\LastKnownGoodPlatformCandidate = C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0


_raw:
12/11/2025 09:56:12.483 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1167
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = InitializeMiscConfigLibrary
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = PostPlatformUpdate


_raw:
12/11/2025 09:56:12.483 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1166
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\IsServiceRunning = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1


_raw:
12/11/2025 09:56:12.005 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5017
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1165
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus service feature has encountered an error and failed.
 	Feature: MDE AV Configurations
  	Failure Reason: Group Policy hive was not ready when MDE AV service started and AV configurations might be not as expected.
 	Recommended Mitigation: Investigate recent changes in Group Policy server settings and reboot the device.
 	Error Code: 0x80070002
 	Error description: The system cannot find the file specified.


_raw:
12/11/2025 09:56:11.528 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win03
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1164
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\CleanupComponentProgress = CleanupCompleted
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\CleanupComponentProgress = CleanupEngine


_raw:
12/11/2025 09:56:11.004 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1175
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = PostPlatformUpdate
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = LoadingEngine


_raw:
12/11/2025 09:56:11.003 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1174
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: Default\ServiceStartStates = 0x0
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceStartStates = 0x1


_raw:
12/11/2025 09:56:10.416 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1173
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\LastKnownGoodPlatformCandidate = C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25100.9008-0
 	New value: Default\Diagnostics\LastKnownGoodPlatformCandidate =


_raw:
12/11/2025 09:56:10.416 AM
LogName=Microsoft-Windows-Windows Defender/Operational
EventCode=5007
EventType=4
ComputerName=cptc11-regional-main-t1-vdi-win02
User=NOT_TRANSLATED
Sid=S-1-5-18
SidType=0
SourceName=Microsoft-Windows-Windows Defender
Type=Information
RecordNumber=1172
Keywords=None
TaskCategory=None
OpCode=Info
Message=Microsoft Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
 	Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = InitializeMiscConfigLibrary
 	New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Diagnostics\InitializingComponentProgress = PostPlatformUpdate