Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:58:32 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Windows Modules Installer service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:58:32.243161800Z" />
    <EventRecordID>6491</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="2632" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Modules Installer</Data>
    <Data Name="param2">running</Data>
    <Binary>540072007500730074006500640049006E007300740061006C006C00650072002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:58:28 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Network Connections service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:58:28.951556000Z" />
    <EventRecordID>6490</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="2632" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Network Connections</Data>
    <Data Name="param2">running</Data>
    <Binary>4E00650074006D0061006E002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-GroupPolicy
Date:          4/20/2011 10:58:20 AM
Event ID:      1110
Task Category: None
Level:         Error
Keywords:      
User:          WTBHOME\wtbadmin
Computer:      big-rig.wtbhome.net
Description:
The processing of Group Policy failed. Windows could not determine if the user and computer accounts are in the same forest. Ensure the user domain name matches the name of a trusted domain that resides in the same forest as the computer account.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-GroupPolicy" Guid="{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}" />
    <EventID>1110</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>1</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:58:20.418341100Z" />
    <EventRecordID>6489</EventRecordID>
    <Correlation ActivityID="{7D671208-7F0C-4E19-950D-B615A3C39F8C}" />
    <Execution ProcessID="980" ThreadID="1340" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-21-1229272821-746137067-1708537768-500" />
  </System>
  <EventData>
    <Data Name="SupportInfo1">1</Data>
    <Data Name="SupportInfo2">1758</Data>
    <Data Name="ProcessingMode">1</Data>
    <Data Name="ProcessingTimeInMilliseconds">30015</Data>
    <Data Name="ErrorCode">1717</Data>
    <Data Name="ErrorDescription">The interface is unknown. </Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Winlogon
Date:          4/20/2011 10:57:50 AM
Event ID:      7001
Task Category: (1101)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      big-rig.wtbhome.net
Description:
User Logon Notification for Customer Experience Improvement Program
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" />
    <EventID>7001</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>1101</Task>
    <Opcode>0</Opcode>
    <Keywords>0x2000000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:57:50.045087700Z" />
    <EventRecordID>6488</EventRecordID>
    <Correlation />
    <Execution ProcessID="504" ThreadID="1116" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="TSId">1</Data>
    <Data Name="UserSid">S-1-5-21-1229272821-746137067-1708537768-500</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:57:46 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Shell Hardware Detection service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:57:46.020280600Z" />
    <EventRecordID>6487</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="2632" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Shell Hardware Detection</Data>
    <Data Name="param2">running</Data>
    <Binary>5300680065006C006C004800570044006500740065006300740069006F006E002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:57:24 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Shell Hardware Detection service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:57:24.180242300Z" />
    <EventRecordID>6486</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="2832" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Shell Hardware Detection</Data>
    <Data Name="param2">stopped</Data>
    <Binary>5300680065006C006C004800570044006500740065006300740069006F006E002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:56:52 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Portable Device Enumerator Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:56:52.090985900Z" />
    <EventRecordID>6485</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="2632" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Portable Device Enumerator Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>57005000440042007500730045006E0075006D002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:54:52 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Portable Device Enumerator Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:54:52.079975100Z" />
    <EventRecordID>6484</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="2832" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Portable Device Enumerator Service</Data>
    <Data Name="param2">running</Data>
    <Binary>57005000440042007500730045006E0075006D002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-GroupPolicy
Date:          4/20/2011 10:54:50 AM
Event ID:      1129
Task Category: None
Level:         Error
Keywords:      
User:          SYSTEM
Computer:      big-rig.wtbhome.net
Description:
The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has succesfully processed. If you do not see a success message for several hours, then contact your administrator.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-GroupPolicy" Guid="{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}" />
    <EventID>1129</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:54:50.114371700Z" />
    <EventRecordID>6483</EventRecordID>
    <Correlation ActivityID="{FE8D2547-1A46-4273-8F0C-0B4AD9C91F18}" />
    <Execution ProcessID="980" ThreadID="1180" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="SupportInfo1">1</Data>
    <Data Name="SupportInfo2">1254</Data>
    <Data Name="ProcessingMode">1</Data>
    <Data Name="ProcessingTimeInMilliseconds">139683</Data>
    <Data Name="ErrorCode">1222</Data>
    <Data Name="ErrorDescription">The network is not present or not started. </Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DfsSvc
Date:          4/20/2011 10:54:44 AM
Event ID:      14548
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The DFS Namespace service could not initialize the trusted domain information on this domain controller, but it will periodically retry the operation. The return code is in the record data.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DfsSvc" Guid="{7DA4FE0E-FD42-4708-9AA5-89B77A224885}" EventSourceName="DfsSvc" />
    <EventID Qualifiers="49152">14548</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:54:44.000000000Z" />
    <EventRecordID>6482</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData Name="DfsNoTrustedDomainInfo">
    <Binary>B5060000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:54:38 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Windows Update service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:54:38.570351400Z" />
    <EventRecordID>6481</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="2832" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Update</Data>
    <Data Name="param2">running</Data>
    <Binary>770075006100750073006500720076002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:54:36 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Windows Remote Management (WS-Management) service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:54:36.729548200Z" />
    <EventRecordID>6480</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="656" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Remote Management (WS-Management)</Data>
    <Data Name="param2">running</Data>
    <Binary>570069006E0052004D002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:54:36 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Software Protection service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:54:36.261547300Z" />
    <EventRecordID>6479</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="656" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Software Protection</Data>
    <Data Name="param2">running</Data>
    <Binary>7300700070007300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:54:35 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Distributed Transaction Coordinator service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:54:35.933946800Z" />
    <EventRecordID>6478</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="2832" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Distributed Transaction Coordinator</Data>
    <Data Name="param2">running</Data>
    <Binary>4D0053004400540043002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WinRM
Date:          4/20/2011 10:54:36 AM
Event ID:      10148
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The WinRM service is listening for WS-Management requests. 

 User Action 
 Use the following command to see the specific IPs on which WinRM is listening: 

 winrm enumerate winrm/config/listener
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WinRM" Guid="{A7975C8F-AC13-49F1-87DA-5A984A4AB417}" EventSourceName="WinRM" />
    <EventID Qualifiers="7">10148</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:54:36.000000000Z" />
    <EventRecordID>6477</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData Name="Started Listening">
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WinRM
Date:          4/20/2011 10:54:36 AM
Event ID:      10154
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The WinRM service failed to create the following SPNs: WSMAN/big-rig.wtbhome.net; WSMAN/big-rig. 

 Additional Data 
 The error received was 1355: %%1355.

 User Action 
 The SPNs can be created by an administrator using setspn.exe utility.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WinRM" Guid="{A7975C8F-AC13-49F1-87DA-5A984A4AB417}" EventSourceName="WinRM" />
    <EventID Qualifiers="7">10154</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:54:36.000000000Z" />
    <EventRecordID>6476</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="spn1">WSMAN/big-rig.wtbhome.net</Data>
    <Data Name="spn2">WSMAN/big-rig</Data>
    <Data Name="error">1355</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:54:33 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Intel(R) Rapid Storage Technology service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:54:33.671942800Z" />
    <EventRecordID>6475</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="656" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Intel(R) Rapid Storage Technology</Data>
    <Data Name="param2">running</Data>
    <Binary>49004100530074006F00720044006100740061004D00670072005300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:54:31 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Windows Font Cache Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:54:31.051138200Z" />
    <EventRecordID>6474</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="656" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Font Cache Service</Data>
    <Data Name="param2">running</Data>
    <Binary>46006F006E007400430061006300680065002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:54:30 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Diagnostic System Host service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:54:30.879537900Z" />
    <EventRecordID>6473</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="656" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Diagnostic System Host</Data>
    <Data Name="param2">running</Data>
    <Binary>570064006900530079007300740065006D0048006F00730074002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:54:30 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Diagnostic Policy Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:54:30.863937900Z" />
    <EventRecordID>6472</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="656" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Diagnostic Policy Service</Data>
    <Data Name="param2">running</Data>
    <Binary>4400500053002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:54:30 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Portable Device Enumerator Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:54:30.692337600Z" />
    <EventRecordID>6471</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="656" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Portable Device Enumerator Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>57005000440042007500730045006E0075006D002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:54:30 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Microsoft .NET Framework NGEN v4.0.30319_X64 service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:54:30.661137500Z" />
    <EventRecordID>6470</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="656" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Microsoft .NET Framework NGEN v4.0.30319_X64</Data>
    <Data Name="param2">stopped</Data>
    <Binary>63006C0072005F006F007000740069006D0069007A006100740069006F006E005F00760034002E0030002E00330030003300310039005F00360034002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:54:30 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Microsoft .NET Framework NGEN v4.0.30319_X64 service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:54:30.661137500Z" />
    <EventRecordID>6469</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="656" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Microsoft .NET Framework NGEN v4.0.30319_X64</Data>
    <Data Name="param2">running</Data>
    <Binary>63006C0072005F006F007000740069006D0069007A006100740069006F006E005F00760034002E0030002E00330030003300310039005F00360034002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:54:30 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Microsoft .NET Framework NGEN v4.0.30319_X86 service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:54:30.520737300Z" />
    <EventRecordID>6468</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="656" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Microsoft .NET Framework NGEN v4.0.30319_X86</Data>
    <Data Name="param2">stopped</Data>
    <Binary>63006C0072005F006F007000740069006D0069007A006100740069006F006E005F00760034002E0030002E00330030003300310039005F00330032002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:54:30 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Microsoft .NET Framework NGEN v4.0.30319_X86 service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:54:30.520737300Z" />
    <EventRecordID>6467</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="656" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Microsoft .NET Framework NGEN v4.0.30319_X86</Data>
    <Data Name="param2">running</Data>
    <Binary>63006C0072005F006F007000740069006D0069007A006100740069006F006E005F00760034002E0030002E00330030003300310039005F00330032002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DfsSvc
Date:          4/20/2011 10:54:29 AM
Event ID:      14548
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The DFS Namespace service could not initialize the trusted domain information on this domain controller, but it will periodically retry the operation. The return code is in the record data.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DfsSvc" Guid="{7DA4FE0E-FD42-4708-9AA5-89B77A224885}" EventSourceName="DfsSvc" />
    <EventID Qualifiers="49152">14548</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:54:29.000000000Z" />
    <EventRecordID>6466</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData Name="DfsNoTrustedDomainInfo">
    <Binary>B5060000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DfsSvc
Date:          4/20/2011 10:54:14 AM
Event ID:      14548
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The DFS Namespace service could not initialize the trusted domain information on this domain controller, but it will periodically retry the operation. The return code is in the record data.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DfsSvc" Guid="{7DA4FE0E-FD42-4708-9AA5-89B77A224885}" EventSourceName="DfsSvc" />
    <EventID Qualifiers="49152">14548</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:54:14.000000000Z" />
    <EventRecordID>6465</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData Name="DfsNoTrustedDomainInfo">
    <Binary>B5060000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DfsSvc
Date:          4/20/2011 10:53:59 AM
Event ID:      14548
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The DFS Namespace service could not initialize the trusted domain information on this domain controller, but it will periodically retry the operation. The return code is in the record data.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DfsSvc" Guid="{7DA4FE0E-FD42-4708-9AA5-89B77A224885}" EventSourceName="DfsSvc" />
    <EventID Qualifiers="49152">14548</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:53:59.000000000Z" />
    <EventRecordID>6464</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData Name="DfsNoTrustedDomainInfo">
    <Binary>B5060000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DfsSvc
Date:          4/20/2011 10:53:44 AM
Event ID:      14548
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The DFS Namespace service could not initialize the trusted domain information on this domain controller, but it will periodically retry the operation. The return code is in the record data.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DfsSvc" Guid="{7DA4FE0E-FD42-4708-9AA5-89B77A224885}" EventSourceName="DfsSvc" />
    <EventID Qualifiers="49152">14548</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:53:44.000000000Z" />
    <EventRecordID>6463</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData Name="DfsNoTrustedDomainInfo">
    <Binary>B5060000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DfsSvc
Date:          4/20/2011 10:53:29 AM
Event ID:      14548
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The DFS Namespace service could not initialize the trusted domain information on this domain controller, but it will periodically retry the operation. The return code is in the record data.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DfsSvc" Guid="{7DA4FE0E-FD42-4708-9AA5-89B77A224885}" EventSourceName="DfsSvc" />
    <EventID Qualifiers="49152">14548</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:53:29.000000000Z" />
    <EventRecordID>6462</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData Name="DfsNoTrustedDomainInfo">
    <Binary>B5060000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DfsSvc
Date:          4/20/2011 10:53:14 AM
Event ID:      14548
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The DFS Namespace service could not initialize the trusted domain information on this domain controller, but it will periodically retry the operation. The return code is in the record data.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DfsSvc" Guid="{7DA4FE0E-FD42-4708-9AA5-89B77A224885}" EventSourceName="DfsSvc" />
    <EventID Qualifiers="49152">14548</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:53:14.000000000Z" />
    <EventRecordID>6461</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData Name="DfsNoTrustedDomainInfo">
    <Binary>B5060000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DfsSvc
Date:          4/20/2011 10:52:59 AM
Event ID:      14548
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The DFS Namespace service could not initialize the trusted domain information on this domain controller, but it will periodically retry the operation. The return code is in the record data.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DfsSvc" Guid="{7DA4FE0E-FD42-4708-9AA5-89B77A224885}" EventSourceName="DfsSvc" />
    <EventID Qualifiers="49152">14548</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:59.000000000Z" />
    <EventRecordID>6460</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData Name="DfsNoTrustedDomainInfo">
    <Binary>B5060000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DfsSvc
Date:          4/20/2011 10:52:44 AM
Event ID:      14548
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The DFS Namespace service could not initialize the trusted domain information on this domain controller, but it will periodically retry the operation. The return code is in the record data.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DfsSvc" Guid="{7DA4FE0E-FD42-4708-9AA5-89B77A224885}" EventSourceName="DfsSvc" />
    <EventID Qualifiers="49152">14548</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:44.000000000Z" />
    <EventRecordID>6459</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData Name="DfsNoTrustedDomainInfo">
    <Binary>B5060000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        LsaSrv
Date:          4/20/2011 10:52:31 AM
Event ID:      40961
Task Category: None
Level:         Warning
Keywords:      
User:          SYSTEM
Computer:      big-rig.wtbhome.net
Description:
The Security System could not establish a secured connection with the server ldap/wtbhome.net/wtbhome.net@WTBHOME.NET. No authentication protocol was available.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="LsaSrv" Guid="{199FE037-2B82-40A9-82AC-E1D46C792B99}" />
    <EventID>40961</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:31.523728200Z" />
    <EventRecordID>6458</EventRecordID>
    <Correlation />
    <Execution ProcessID="576" ThreadID="744" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Target">ldap/wtbhome.net/wtbhome.net@WTBHOME.NET</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:52:31 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Virtual Disk service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:31.118127500Z" />
    <EventRecordID>6457</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="656" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Virtual Disk</Data>
    <Data Name="param2">running</Data>
    <Binary>7600640073002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:52:30 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The WinHTTP Web Proxy Auto-Discovery Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:30.806127000Z" />
    <EventRecordID>6456</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="656" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">WinHTTP Web Proxy Auto-Discovery Service</Data>
    <Data Name="param2">running</Data>
    <Binary>570069006E0048007400740070004100750074006F00500072006F00780079005300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:52:30 AM
Event ID:      7023
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Windows Time service terminated with the following error: 
An attempt was made to logon, but the network logon service was not started.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="49152">7023</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:30.728126900Z" />
    <EventRecordID>6455</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="656" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Time</Data>
    <Data Name="param2">%%1792</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:52:30 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Windows Time service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:30.728126900Z" />
    <EventRecordID>6454</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="656" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Time</Data>
    <Data Name="param2">stopped</Data>
    <Binary>570033003200540069006D0065002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Time-Service
Date:          4/20/2011 10:52:30 AM
Event ID:      46
Task Category: None
Level:         Error
Keywords:      
User:          LOCAL SERVICE
Computer:      big-rig.wtbhome.net
Description:
The time service encountered an error and was forced to shut down. The error was: 0x80070700: An attempt was made to logon, but the network logon service was not started.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Time-Service" Guid="{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}" />
    <EventID>46</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:30.712526800Z" />
    <EventRecordID>6453</EventRecordID>
    <Correlation />
    <Execution ProcessID="152" ThreadID="2428" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData Name="TMP_EVENT_ERROR_SHUTDOWN">
    <Data Name="ErrorMessage">0x80070700: An attempt was made to logon, but the network logon service was not started.
</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Virtual Disk Service
Date:          4/20/2011 10:52:31 AM
Event ID:      3
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
Service started.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Virtual Disk Service" />
    <EventID Qualifiers="16896">3</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:31.000000000Z" />
    <EventRecordID>6452</EventRecordID>
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data>@2010005</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:52:30 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Portable Device Enumerator Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:30.665726700Z" />
    <EventRecordID>6451</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="656" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Portable Device Enumerator Service</Data>
    <Data Name="param2">running</Data>
    <Binary>57005000440042007500730045006E0075006D002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:52:30 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Network List Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:30.525326500Z" />
    <EventRecordID>6450</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="676" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Network List Service</Data>
    <Data Name="param2">running</Data>
    <Binary>6E0065007400700072006F0066006D002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:52:30 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Net.Pipe Listener Adapter service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:30.416126300Z" />
    <EventRecordID>6449</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="640" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Net.Pipe Listener Adapter</Data>
    <Data Name="param2">running</Data>
    <Binary>4E0065007400500069007000650041006300740069007600610074006F0072002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:52:30 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Net.Tcp Listener Adapter service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:30.416126300Z" />
    <EventRecordID>6448</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="656" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Net.Tcp Listener Adapter</Data>
    <Data Name="param2">running</Data>
    <Binary>4E006500740054006300700041006300740069007600610074006F0072002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:52:30 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Net.Tcp Port Sharing Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:30.338126200Z" />
    <EventRecordID>6447</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="656" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Net.Tcp Port Sharing Service</Data>
    <Data Name="param2">running</Data>
    <Binary>4E006500740054006300700050006F0072007400530068006100720069006E0067002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DfsSvc
Date:          4/20/2011 10:52:29 AM
Event ID:      14548
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The DFS Namespace service could not initialize the trusted domain information on this domain controller, but it will periodically retry the operation. The return code is in the record data.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DfsSvc" Guid="{7DA4FE0E-FD42-4708-9AA5-89B77A224885}" EventSourceName="DfsSvc" />
    <EventID Qualifiers="49152">14548</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:29.000000000Z" />
    <EventRecordID>6446</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData Name="DfsNoTrustedDomainInfo">
    <Binary>B5060000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:52:25 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The File Replication Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:25.283717300Z" />
    <EventRecordID>6445</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="656" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">File Replication Service</Data>
    <Data Name="param2">running</Data>
    <Binary>4E0074004600720073002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Iphlpsvc
Date:          4/20/2011 10:52:19 AM
Event ID:      4200
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      big-rig.wtbhome.net
Description:
Isatap interface isatap.{9E9F4615-1412-4E0A-AB1D-005BCDF16A41} with address fe80::5efe:192.168.0.2 has been brought up.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Iphlpsvc" Guid="{66A5C15C-4F8E-4044-BF6E-71D896038977}" />
    <EventID>4200</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:19.418107000Z" />
    <EventRecordID>6444</EventRecordID>
    <Correlation />
    <Execution ProcessID="980" ThreadID="1236" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="ProtocolType">1</Data>
    <Data Name="Interface">isatap.{9E9F4615-1412-4E0A-AB1D-005BCDF16A41}</Data>
    <Data Name="Address">fe80::5efe:192.168.0.2</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DHCP-Server
Date:          4/20/2011 10:52:19 AM
Event ID:      1044
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The DHCP/BINL service on the local machine, belonging to the Windows Administrative domain wtbhome.net, has determined that it is authorized to start. It is servicing clients now.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DHCP-Server" Guid="{6D64F02C-A125-4DAC-9A01-F0555B41CA84}" EventSourceName="DhcpServer" />
    <EventID Qualifiers="0">1044</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:19.000000000Z" />
    <EventRecordID>6443</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>wtbhome.net</Data>
    <Data>0</Data>
    <Binary>00000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:52:18 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The DHCP Server service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:18.591305500Z" />
    <EventRecordID>6442</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="640" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">DHCP Server</Data>
    <Data Name="param2">running</Data>
    <Binary>44004800430050005300650072007600650072002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DHCP-Server
Date:          4/20/2011 10:52:18 AM
Event ID:      10020
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
This computer has at least one dynamically assigned IPv6 address.For reliable DHCPv6 server operation, you should use only static IPv6 addresses.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DHCP-Server" Guid="{6D64F02C-A125-4DAC-9A01-F0555B41CA84}" EventSourceName="DhcpServer" />
    <EventID Qualifiers="0">10020</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:18.000000000Z" />
    <EventRecordID>6441</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:52:15 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The IP Helper service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:15.377699900Z" />
    <EventRecordID>6440</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="676" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">IP Helper</Data>
    <Data Name="param2">running</Data>
    <Binary>6900700068006C0070007300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:52:15 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The World Wide Web Publishing Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:15.206099600Z" />
    <EventRecordID>6439</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="676" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">World Wide Web Publishing Service</Data>
    <Data Name="param2">running</Data>
    <Binary>570033005300560043002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:52:15 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Windows Process Activation Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:15.096899400Z" />
    <EventRecordID>6438</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="676" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Process Activation Service</Data>
    <Data Name="param2">running</Data>
    <Binary>5700410053002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:52:14 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Windows Management Instrumentation service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:14.301298000Z" />
    <EventRecordID>6437</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="676" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Management Instrumentation</Data>
    <Data Name="param2">running</Data>
    <Binary>570069006E006D0067006D0074002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DNS-Client
Date:          4/20/2011 10:52:14 AM
Event ID:      1014
Task Category: None
Level:         Warning
Keywords:      
User:          NETWORK SERVICE
Computer:      big-rig.wtbhome.net
Description:
Name resolution for the name _ldap._tcp.dc._msdcs.wtbhome.net timed out after none of the configured DNS servers responded.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DNS-Client" Guid="{1C95126E-7EEA-49A9-A3FE-A378B03DDB4D}" />
    <EventID>1014</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:14.254497900Z" />
    <EventRecordID>6436</EventRecordID>
    <Correlation />
    <Execution ProcessID="460" ThreadID="360" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-20" />
  </System>
  <EventData>
    <Data Name="QueryName">_ldap._tcp.dc._msdcs.wtbhome.net</Data>
    <Data Name="AddressLength">16</Data>
    <Data Name="Address">020000357F0000010000000000000000</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:52:14 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The DFS Namespace service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:14.176497800Z" />
    <EventRecordID>6435</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="676" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">DFS Namespace</Data>
    <Data Name="param2">running</Data>
    <Binary>4400660073002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:52:13 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Remote Registry service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:13.755297000Z" />
    <EventRecordID>6434</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="640" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Remote Registry</Data>
    <Data Name="param2">running</Data>
    <Binary>520065006D006F0074006500520065006700690073007400720079002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:52:13 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The DNS Server service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:13.755297000Z" />
    <EventRecordID>6433</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="640" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">DNS Server</Data>
    <Data Name="param2">running</Data>
    <Binary>44004E0053002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DfsSvc
Date:          4/20/2011 10:52:14 AM
Event ID:      14531
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
DFS server has finished initializing.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DfsSvc" Guid="{7DA4FE0E-FD42-4708-9AA5-89B77A224885}" EventSourceName="DfsSvc" />
    <EventID Qualifiers="16384">14531</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:14.000000000Z" />
    <EventRecordID>6432</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData Name="DfsFinishInit">
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DfsSvc
Date:          4/20/2011 10:52:14 AM
Event ID:      14533
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
DFS has finished building all namespaces.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DfsSvc" Guid="{7DA4FE0E-FD42-4708-9AA5-89B77A224885}" EventSourceName="DfsSvc" />
    <EventID Qualifiers="16384">14533</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:14.000000000Z" />
    <EventRecordID>6431</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData Name="DfsFinishBuildingNamespace">
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DfsSvc
Date:          4/20/2011 10:52:14 AM
Event ID:      14548
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The DFS Namespace service could not initialize the trusted domain information on this domain controller, but it will periodically retry the operation. The return code is in the record data.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DfsSvc" Guid="{7DA4FE0E-FD42-4708-9AA5-89B77A224885}" EventSourceName="DfsSvc" />
    <EventID Qualifiers="49152">14548</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:14.000000000Z" />
    <EventRecordID>6430</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData Name="DfsNoTrustedDomainInfo">
    <Binary>B5060000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:52:11 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Network Location Awareness service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:52:11.758493500Z" />
    <EventRecordID>6429</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="640" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Network Location Awareness</Data>
    <Data Name="param2">running</Data>
    <Binary>4E006C0061005300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:58 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Intersite Messaging service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:58.061669500Z" />
    <EventRecordID>6428</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="636" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Intersite Messaging</Data>
    <Data Name="param2">running</Data>
    <Binary>490073006D0053006500720076002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:58 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Application Host Helper Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:58.030469400Z" />
    <EventRecordID>6427</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="636" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Application Host Helper Service</Data>
    <Data Name="param2">running</Data>
    <Binary>41007000700048006F00730074005300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:57 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The DFS Replication service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:57.328468200Z" />
    <EventRecordID>6426</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="676" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">DFS Replication</Data>
    <Data Name="param2">running</Data>
    <Binary>44004600530052002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:57 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Active Directory Web Services service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:57.281668100Z" />
    <EventRecordID>6425</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="676" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Active Directory Web Services</Data>
    <Data Name="param2">running</Data>
    <Binary>41004400570053002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:56 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Cryptographic Services service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:56.720067100Z" />
    <EventRecordID>6424</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="676" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Cryptographic Services</Data>
    <Data Name="param2">running</Data>
    <Binary>430072007900700074005300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:53 AM
Event ID:      7023
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Netlogon service terminated with the following error: 
%%-1073741724
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="49152">7023</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:53.116460800Z" />
    <EventRecordID>6423</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="636" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Netlogon</Data>
    <Data Name="param2">%%-1073741724</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:53 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Netlogon service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:53.100860800Z" />
    <EventRecordID>6422</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="636" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Netlogon</Data>
    <Data Name="param2">stopped</Data>
    <Binary>4E00650074006C006F0067006F006E002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:51 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Active@ Disk Monitor service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:51.384857700Z" />
    <EventRecordID>6421</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="676" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Active@ Disk Monitor</Data>
    <Data Name="param2">running</Data>
    <Binary>410063007400690076006500400020004400690073006B0020004D006F006E00690074006F0072002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Server
Date:          4/20/2011 10:51:53 AM
Event ID:      2506
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The value named BIG-RIG in the server's registry key OptionalNames was not valid, and was ignored. If you want to change the value, change it to one that is the correct type and is within the acceptable range, or delete the value to use the default. This value might have been set up by an older program that did not use the correct boundaries.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Server" />
    <EventID Qualifiers="32768">2506</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:53.000000000Z" />
    <EventRecordID>6420</EventRecordID>
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data>BIG-RIG</Data>
    <Data>OptionalNames</Data>
    <Binary>34000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:50 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Print Spooler service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:50.168055600Z" />
    <EventRecordID>6419</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="676" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Print Spooler</Data>
    <Data Name="param2">running</Data>
    <Binary>530070006F006F006C00650072002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        NETLOGON
Date:          4/20/2011 10:51:49 AM
Event ID:      5602
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
An internal error occurred while accessing the computer's local or network security database.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="NETLOGON" />
    <EventID Qualifiers="0">5602</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:49.000000000Z" />
    <EventRecordID>6418</EventRecordID>
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data>%%1317</Data>
    <Binary>640000C0</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Server
Date:          4/20/2011 10:51:46 AM
Event ID:      2506
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The value named BIG-RIG in the server's registry key OptionalNames was not valid, and was ignored. If you want to change the value, change it to one that is the correct type and is within the acceptable range, or delete the value to use the default. This value might have been set up by an older program that did not use the correct boundaries.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Server" />
    <EventID Qualifiers="32768">2506</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:46.000000000Z" />
    <EventRecordID>6417</EventRecordID>
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data>BIG-RIG</Data>
    <Data>OptionalNames</Data>
    <Binary>34000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:44 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Server service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:44.286845300Z" />
    <EventRecordID>6416</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="636" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Server</Data>
    <Data Name="param2">running</Data>
    <Binary>4C0061006E006D0061006E005300650072007600650072002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:43 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Security Accounts Manager service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:43.740844300Z" />
    <EventRecordID>6415</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="676" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Security Accounts Manager</Data>
    <Data Name="param2">running</Data>
    <Binary>530061006D00530073002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:40 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Kerberos Key Distribution Center service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:40.480438600Z" />
    <EventRecordID>6414</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="640" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Kerberos Key Distribution Center</Data>
    <Data Name="param2">running</Data>
    <Binary>6B00640063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:39 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Workstation service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:39.404036700Z" />
    <EventRecordID>6413</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="676" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Workstation</Data>
    <Data Name="param2">running</Data>
    <Binary>4C0061006E006D0061006E0057006F0072006B00730074006100740069006F006E002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:39 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Windows Firewall service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:39.185636300Z" />
    <EventRecordID>6412</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="676" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Firewall</Data>
    <Data Name="param2">running</Data>
    <Binary>4D00700073005300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kerberos-Key-Distribution-Center
Date:          4/20/2011 10:51:40 AM
Event ID:      29
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Key Distribution Center (KDC) cannot find a suitable certificate to use for smart card logons, or the KDC certificate could not be verified. Smart card logon may not function correctly if this problem is not resolved. To correct this problem, either verify the existing KDC certificate using certutil.exe or enroll for a new KDC certificate.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kerberos-Key-Distribution-Center" Guid="{3FD9DA1A-5A54-46C5-9A26-9BD7C0685056}" EventSourceName="KDC" />
    <EventID Qualifiers="32768">29</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:40.000000000Z" />
    <EventRecordID>6411</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:38 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Base Filtering Engine service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:38.717635500Z" />
    <EventRecordID>6410</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="640" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Base Filtering Engine</Data>
    <Data Name="param2">running</Data>
    <Binary>4200460045002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:38 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Task Scheduler service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:38.530435200Z" />
    <EventRecordID>6409</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="676" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Task Scheduler</Data>
    <Data Name="param2">running</Data>
    <Binary>5300630068006500640075006C0065002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:37 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Shell Hardware Detection service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:37.360433100Z" />
    <EventRecordID>6408</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="676" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Shell Hardware Detection</Data>
    <Data Name="param2">running</Data>
    <Binary>5300680065006C006C004800570044006500740065006300740069006F006E002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:37 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The DNS Client service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:37.266833000Z" />
    <EventRecordID>6407</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="676" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">DNS Client</Data>
    <Data Name="param2">running</Data>
    <Binary>44006E007300630061006300680065002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:37 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The DHCP Client service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:37.235632900Z" />
    <EventRecordID>6406</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="676" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">DHCP Client</Data>
    <Data Name="param2">running</Data>
    <Binary>44006800630070002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DHCPv6-Client
Date:          4/20/2011 10:51:37 AM
Event ID:      51046
Task Category: Service State Event
Level:         Information
Keywords:      
User:          LOCAL SERVICE
Computer:      big-rig.wtbhome.net
Description:
DHCPv6 client service is started
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DHCPv6-Client" Guid="{6A1F2B00-6A90-4C38-95A5-5CAB3B056778}" />
    <EventID>51046</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>62</Opcode>
    <Keywords>0x2000000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:37.235632900Z" />
    <EventRecordID>6405</EventRecordID>
    <Correlation />
    <Execution ProcessID="932" ThreadID="380" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Dhcp-Client
Date:          4/20/2011 10:51:37 AM
Event ID:      50036
Task Category: Service State Event
Level:         Information
Keywords:      
User:          LOCAL SERVICE
Computer:      big-rig.wtbhome.net
Description:
DHCPv4 client service is started
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Dhcp-Client" Guid="{15A7A4F8-0072-4EAB-ABAD-F98A4D666AED}" />
    <EventID>50036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>68</Opcode>
    <Keywords>0x2000000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:37.188832800Z" />
    <EventRecordID>6404</EventRecordID>
    <Correlation />
    <Execution ProcessID="932" ThreadID="464" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:37 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The TCP/IP NetBIOS Helper service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:37.126432700Z" />
    <EventRecordID>6403</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="676" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">TCP/IP NetBIOS Helper</Data>
    <Data Name="param2">running</Data>
    <Binary>6C006D0068006F007300740073002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:37 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Network Store Interface Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:37.017232500Z" />
    <EventRecordID>6402</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="676" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Network Store Interface Service</Data>
    <Data Name="param2">running</Data>
    <Binary>6E00730069002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:36 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Desktop Window Manager Session Manager service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:36.798832100Z" />
    <EventRecordID>6401</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="676" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Desktop Window Manager Session Manager</Data>
    <Data Name="param2">running</Data>
    <Binary>5500780053006D0073002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:36 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The System Event Notification Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:36.705232000Z" />
    <EventRecordID>6400</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="676" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">System Event Notification Service</Data>
    <Data Name="param2">running</Data>
    <Binary>530045004E0053002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:36 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The COM+ Event System service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:36.580431700Z" />
    <EventRecordID>6399</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="676" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">COM+ Event System</Data>
    <Data Name="param2">running</Data>
    <Binary>4500760065006E007400530079007300740065006D002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:36 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The User Profile Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:36.330831300Z" />
    <EventRecordID>6398</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="676" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">User Profile Service</Data>
    <Data Name="param2">running</Data>
    <Binary>500072006F0066005300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:36 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Group Policy Client service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:36.237231100Z" />
    <EventRecordID>6397</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="640" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Group Policy Client</Data>
    <Data Name="param2">running</Data>
    <Binary>670070007300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:35 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Windows Event Log service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:35.722430200Z" />
    <EventRecordID>6396</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="656" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Event Log</Data>
    <Data Name="param2">running</Data>
    <Binary>6500760065006E0074006C006F0067002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:35 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Remote Procedure Call (RPC) service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:35.394829700Z" />
    <EventRecordID>6395</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="640" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Remote Procedure Call (RPC)</Data>
    <Data Name="param2">running</Data>
    <Binary>520070006300530073002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:35 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The RPC Endpoint Mapper service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:35.348029600Z" />
    <EventRecordID>6394</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="640" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">RPC Endpoint Mapper</Data>
    <Data Name="param2">running</Data>
    <Binary>5200700063004500700074004D00610070007000650072002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:35 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The DCOM Server Process Launcher service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:35.301229500Z" />
    <EventRecordID>6393</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="640" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">DCOM Server Process Launcher</Data>
    <Data Name="param2">running</Data>
    <Binary>440063006F006D004C00610075006E00630068002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:35 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Active Directory Domain Services service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:35.207629300Z" />
    <EventRecordID>6392</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="640" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Active Directory Domain Services</Data>
    <Data Name="param2">running</Data>
    <Binary>4E005400440053002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-FilterManager
Date:          4/20/2011 10:51:34 AM
Event ID:      6
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      big-rig.wtbhome.net
Description:
File System Filter 'luafv' (6.1, ‎2009‎-‎07‎-‎13T19:26:13.000000000Z) has successfully loaded and registered with Filter Manager.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
    <EventID>6</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:34.692828400Z" />
    <EventRecordID>6391</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="76" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="FinalStatus">0x0</Data>
    <Data Name="DeviceVersionMajor">6</Data>
    <Data Name="DeviceVersionMinor">1</Data>
    <Data Name="DeviceNameLength">5</Data>
    <Data Name="DeviceName">luafv</Data>
    <Data Name="DeviceTime">2009-07-13T19:26:13.000000000Z</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:34 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Power service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:34.505628100Z" />
    <EventRecordID>6390</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="640" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Power</Data>
    <Data Name="param2">running</Data>
    <Binary>50006F007700650072002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-UserPnp
Date:          4/20/2011 10:51:34 AM
Event ID:      20010
Task Category: (7010)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      big-rig.wtbhome.net
Description:
One or more of the Plug and Play service's subsystems has changed state. 

PlugPlay install subsystem enabled: 'true' 
PlugPlay caching subsystem enabled: 'true' 

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-UserPnp" Guid="{96F4A050-7E31-453C-88BE-9634F4E02139}" />
    <EventID>20010</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>7010</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:34.334027800Z" />
    <EventRecordID>6389</EventRecordID>
    <Correlation />
    <Execution ProcessID="756" ThreadID="772" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <INFO_PNP_STATE xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://manifests.microsoft.com/win/2004/08/windows/userpnp">
      <InstallSubsystemState>true</InstallSubsystemState>
      <CachingSubsystemState>true</CachingSubsystemState>
    </INFO_PNP_STATE>
  </UserData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:51:34 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Plug and Play service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:34.334027800Z" />
    <EventRecordID>6388</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="640" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Plug and Play</Data>
    <Data Name="param2">running</Data>
    <Binary>50006C007500670050006C00610079002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        yukonw7
Date:          4/20/2011 10:51:25 AM
Event ID:      134
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
Pause Function is Rx and TX
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="yukonw7" />
    <EventID Qualifiers="24583">134</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:25.691612600Z" />
    <EventRecordID>6387</EventRecordID>
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data>\Device\NDMP4</Data>
    <Data>Marvell Yukon 88E8056 PCI-E Gigabit Ethernet Controller</Data>
    <Binary>00000000020030000000000086000760000000000000000000000000000000000000000000000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        yukonw7
Date:          4/20/2011 10:51:25 AM
Event ID:      128
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
Duplex State is Full Duplex
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="yukonw7" />
    <EventID Qualifiers="24583">128</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:25.691612600Z" />
    <EventRecordID>6386</EventRecordID>
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data>\Device\NDMP4</Data>
    <Data>Marvell Yukon 88E8056 PCI-E Gigabit Ethernet Controller</Data>
    <Binary>00000000020030000000000080000760000000000000000000000000000000000000000000000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        yukonw7
Date:          4/20/2011 10:51:25 AM
Event ID:      123
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
Port A is up with 1000 Mbps
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="yukonw7" />
    <EventID Qualifiers="24583">123</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:25.691612600Z" />
    <EventRecordID>6385</EventRecordID>
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data>\Device\NDMP4</Data>
    <Data>Marvell Yukon 88E8056 PCI-E Gigabit Ethernet Controller</Data>
    <Binary>0000080002003800000000007B000760000000000000000000000000000000000000000000000000BCAEC5292C120000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        yukonw7
Date:          4/20/2011 10:51:23 AM
Event ID:      138
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
Autonegotiation Mode 2
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="yukonw7" />
    <EventID Qualifiers="24583">138</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:23.024007900Z" />
    <EventRecordID>6384</EventRecordID>
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data>\Device\NDMP4</Data>
    <Data>Marvell Yukon 88E8056 PCI-E Gigabit Ethernet Controller</Data>
    <Binary>0000000002003000000000008A000760000000000000000000000000000000000000000000000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Processor-Power
Date:          4/20/2011 10:51:22 AM
Event ID:      26
Task Category: (4)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      big-rig.wtbhome.net
Description:
Processor 3 in group 0 exposes the following:

3 idle state(s)
11 performance state(s)
0 throttle state(s)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Processor-Power" Guid="{0F67E49F-FE51-4E9F-B490-6F2948CC6027}" />
    <EventID>26</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:22.774407500Z" />
    <EventRecordID>6383</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="72" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Group">0</Data>
    <Data Name="Number">3</Data>
    <Data Name="IdleStateCount">3</Data>
    <Data Name="PerfStateCount">11</Data>
    <Data Name="ThrottleStateCount">0</Data>
    <ComplexData Name="IdleState">010303</ComplexData>
    <ComplexData Name="PerfState">61090000640000006009000063000000DB0800005E0000005508000058000000D0070000530000004B0700004D000000C5060000480000004006000042000000BB0500003D0000003505000037000000B004000031000000</ComplexData>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Processor-Power
Date:          4/20/2011 10:51:22 AM
Event ID:      26
Task Category: (4)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      big-rig.wtbhome.net
Description:
Processor 2 in group 0 exposes the following:

3 idle state(s)
11 performance state(s)
0 throttle state(s)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Processor-Power" Guid="{0F67E49F-FE51-4E9F-B490-6F2948CC6027}" />
    <EventID>26</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:22.774407500Z" />
    <EventRecordID>6382</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="72" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Group">0</Data>
    <Data Name="Number">2</Data>
    <Data Name="IdleStateCount">3</Data>
    <Data Name="PerfStateCount">11</Data>
    <Data Name="ThrottleStateCount">0</Data>
    <ComplexData Name="IdleState">010303</ComplexData>
    <ComplexData Name="PerfState">61090000640000006009000063000000DB0800005E0000005508000058000000D0070000530000004B0700004D000000C5060000480000004006000042000000BB0500003D0000003505000037000000B004000031000000</ComplexData>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Processor-Power
Date:          4/20/2011 10:51:22 AM
Event ID:      26
Task Category: (4)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      big-rig.wtbhome.net
Description:
Processor 1 in group 0 exposes the following:

3 idle state(s)
11 performance state(s)
0 throttle state(s)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Processor-Power" Guid="{0F67E49F-FE51-4E9F-B490-6F2948CC6027}" />
    <EventID>26</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:22.774407500Z" />
    <EventRecordID>6381</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="72" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Group">0</Data>
    <Data Name="Number">1</Data>
    <Data Name="IdleStateCount">3</Data>
    <Data Name="PerfStateCount">11</Data>
    <Data Name="ThrottleStateCount">0</Data>
    <ComplexData Name="IdleState">010303</ComplexData>
    <ComplexData Name="PerfState">61090000640000006009000063000000DB0800005E0000005508000058000000D0070000530000004B0700004D000000C5060000480000004006000042000000BB0500003D0000003505000037000000B004000031000000</ComplexData>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Processor-Power
Date:          4/20/2011 10:51:22 AM
Event ID:      26
Task Category: (4)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      big-rig.wtbhome.net
Description:
Processor 0 in group 0 exposes the following:

3 idle state(s)
11 performance state(s)
0 throttle state(s)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Processor-Power" Guid="{0F67E49F-FE51-4E9F-B490-6F2948CC6027}" />
    <EventID>26</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:22.758807500Z" />
    <EventRecordID>6380</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="72" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Group">0</Data>
    <Data Name="Number">0</Data>
    <Data Name="IdleStateCount">3</Data>
    <Data Name="PerfStateCount">11</Data>
    <Data Name="ThrottleStateCount">0</Data>
    <ComplexData Name="IdleState">010303</ComplexData>
    <ComplexData Name="PerfState">61090000640000006009000063000000DB0800005E0000005508000058000000D0070000530000004B0700004D000000C5060000480000004006000042000000BB0500003D0000003505000037000000B004000031000000</ComplexData>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-FilterManager
Date:          4/20/2011 10:51:22 AM
Event ID:      6
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      big-rig.wtbhome.net
Description:
File System Filter 'DfsDriver' (6.1, ‎2009‎-‎07‎-‎13T19:23:44.000000000Z) has successfully loaded and registered with Filter Manager.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
    <EventID>6</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:22.025606200Z" />
    <EventRecordID>6379</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="8" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="FinalStatus">0x0</Data>
    <Data Name="DeviceVersionMajor">6</Data>
    <Data Name="DeviceVersionMinor">1</Data>
    <Data Name="DeviceNameLength">9</Data>
    <Data Name="DeviceName">DfsDriver</Data>
    <Data Name="DeviceTime">2009-07-13T19:23:44.000000000Z</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-FilterManager
Date:          4/20/2011 10:51:19 AM
Event ID:      6
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      big-rig.wtbhome.net
Description:
File System Filter 'DfsrRo' (6.1, ‎2010‎-‎11‎-‎20T05:26:37.000000000Z) has successfully loaded and registered with Filter Manager.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
    <EventID>6</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:19.373601500Z" />
    <EventRecordID>6378</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="8" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="FinalStatus">0x0</Data>
    <Data Name="DeviceVersionMajor">6</Data>
    <Data Name="DeviceVersionMinor">1</Data>
    <Data Name="DeviceNameLength">6</Data>
    <Data Name="DeviceName">DfsrRo</Data>
    <Data Name="DeviceTime">2010-11-20T05:26:37.000000000Z</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          4/20/2011 10:51:18 AM
Event ID:      12
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      big-rig.wtbhome.net
Description:
The operating system started at system time ‎2011‎-‎04‎-‎20T14:51:18.125599300Z.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>12</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:18.609200200Z" />
    <EventRecordID>6377</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="8" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="MajorVersion">6</Data>
    <Data Name="MinorVersion">1</Data>
    <Data Name="BuildVersion">7601</Data>
    <Data Name="QfeVersion">17514</Data>
    <Data Name="ServiceVersion">1</Data>
    <Data Name="BootMode">0</Data>
    <Data Name="StartTime">2011-04-20T14:51:18.125599300Z</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:44 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Windows Process Activation Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:44.916968300Z" />
    <EventRecordID>6376</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3300" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Process Activation Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>5700410053002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-General
Date:          4/20/2011 10:50:44 AM
Event ID:      13
Task Category: None
Level:         Information
Keywords:      
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The operating system is shutting down at system time ‎2011‎-‎04‎-‎20T14:50:44.885768300Z.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
    <EventID>13</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:44.885768300Z" />
    <EventRecordID>6375</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="32" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="StopTime">2011-04-20T14:50:44.885768300Z</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:43 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Windows Modules Installer service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:43.388165600Z" />
    <EventRecordID>6374</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3300" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Modules Installer</Data>
    <Data Name="param2">stopped</Data>
    <Binary>540072007500730074006500640049006E007300740061006C006C00650072002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:43 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The DHCP Server service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:43.388165600Z" />
    <EventRecordID>6373</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3300" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">DHCP Server</Data>
    <Data Name="param2">stopped</Data>
    <Binary>44004800430050005300650072007600650072002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:42 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Active Directory Domain Services service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:42.795364600Z" />
    <EventRecordID>6372</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3300" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Active Directory Domain Services</Data>
    <Data Name="param2">stopped</Data>
    <Binary>4E005400440053002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:41 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The File Replication Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:41.890563000Z" />
    <EventRecordID>6371</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3300" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">File Replication Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>4E0074004600720073002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:41 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The World Wide Web Publishing Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:41.016961500Z" />
    <EventRecordID>6370</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3300" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">World Wide Web Publishing Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>570033005300560043002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:40 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Software Protection service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:40.455360500Z" />
    <EventRecordID>6369</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3300" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Software Protection</Data>
    <Data Name="param2">stopped</Data>
    <Binary>7300700070007300760063002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:39 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Windows Management Instrumentation service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:39.815759400Z" />
    <EventRecordID>6368</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3300" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Management Instrumentation</Data>
    <Data Name="param2">stopped</Data>
    <Binary>570069006E006D0067006D0074002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:39 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Windows Remote Management (WS-Management) service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:39.222958300Z" />
    <EventRecordID>6367</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3300" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Remote Management (WS-Management)</Data>
    <Data Name="param2">stopped</Data>
    <Binary>570069006E0052004D002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Kernel-Power
Date:          4/20/2011 10:50:39 AM
Event ID:      109
Task Category: (103)
Level:         Information
Keywords:      (4)
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The kernel power manager has initiated a shutdown transition.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
    <EventID>109</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>103</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000004</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:39.113758100Z" />
    <EventRecordID>6366</EventRecordID>
    <Correlation />
    <Execution ProcessID="476" ThreadID="480" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ShutdownActionType">5</Data>
    <Data Name="ShutdownEventCode">0</Data>
    <Data Name="ShutdownReason">0</Data>
  </EventData>
</Event>

Log Name:      System
Source:        EventLog
Date:          4/20/2011 10:51:35 AM
Event ID:      6013
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The system uptime is 17 seconds.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="EventLog" />
    <EventID Qualifiers="32768">6013</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:35.000000000Z" />
    <EventRecordID>6365</EventRecordID>
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>17</Data>
    <Data>60</Data>
    <Data>300 Eastern Standard Time</Data>
    <Binary>31002E003100000030000000570069006E0064006F0077007300200053006500720076006500720020003200300030003800200052003200200045006E0074006500720070007200690073006500000036002E0031002E00370036003000310020004200750069006C006400200037003600300031002000530065007200760069006300650020005000610063006B002000310000004D0075006C0074006900700072006F0063006500730073006F00720020004600720065006500000037003600300031002E00770069006E0037007300700031005F00720074006D002E003100300031003100310039002D00310038003500300000003400640039006100380062003500310000004E006F007400200041007600610069006C00610062006C00650000004E006F007400200041007600610069006C00610062006C006500000039000000340000003400300038003800000034003000390000006200690067002D007200690067002E0077007400620068006F006D0065002E006E006500740000000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        EventLog
Date:          4/20/2011 10:51:35 AM
Event ID:      6005
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Event log service was started.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="EventLog" />
    <EventID Qualifiers="32768">6005</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:35.000000000Z" />
    <EventRecordID>6364</EventRecordID>
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Binary>DB070400030014000E003300230094020000000000000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        EventLog
Date:          4/20/2011 10:51:35 AM
Event ID:      6009
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="EventLog" />
    <EventID Qualifiers="32768">6009</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:51:35.000000000Z" />
    <EventRecordID>6363</EventRecordID>
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data>6.01.</Data>
    <Data>7601</Data>
    <Data>Service Pack 1</Data>
    <Data>Multiprocessor Free</Data>
    <Data>17514</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:38 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The User Profile Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:38.676957400Z" />
    <EventRecordID>6362</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3300" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">User Profile Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>500072006F0066005300760063002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:38 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Desktop Window Manager Session Manager service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:38.645757300Z" />
    <EventRecordID>6361</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3300" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Desktop Window Manager Session Manager</Data>
    <Data Name="param2">stopped</Data>
    <Binary>5500780053006D0073002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:38 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Plug and Play service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:38.567757200Z" />
    <EventRecordID>6360</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3300" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Plug and Play</Data>
    <Data Name="param2">stopped</Data>
    <Binary>50006C007500670050006C00610079002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-UserPnp
Date:          4/20/2011 10:50:38 AM
Event ID:      20010
Task Category: (7010)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      big-rig.wtbhome.net
Description:
One or more of the Plug and Play service's subsystems has changed state. 

PlugPlay install subsystem enabled: 'false' 
PlugPlay caching subsystem enabled: 'false' 

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-UserPnp" Guid="{96F4A050-7E31-453C-88BE-9634F4E02139}" />
    <EventID>20010</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>7010</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:38.567757200Z" />
    <EventRecordID>6359</EventRecordID>
    <Correlation />
    <Execution ProcessID="752" ThreadID="3588" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <INFO_PNP_STATE xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://manifests.microsoft.com/win/2004/08/windows/userpnp">
      <InstallSubsystemState>false</InstallSubsystemState>
      <CachingSubsystemState>false</CachingSubsystemState>
    </INFO_PNP_STATE>
  </UserData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:38 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Power service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:38.520957100Z" />
    <EventRecordID>6358</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3300" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Power</Data>
    <Data Name="param2">stopped</Data>
    <Binary>50006F007700650072002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:38 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Net.Pipe Listener Adapter service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:38.333756800Z" />
    <EventRecordID>6357</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3300" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Net.Pipe Listener Adapter</Data>
    <Data Name="param2">stopped</Data>
    <Binary>4E0065007400500069007000650041006300740069007600610074006F0072002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:37 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Net.Tcp Listener Adapter service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:37.506955300Z" />
    <EventRecordID>6356</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3300" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Net.Tcp Listener Adapter</Data>
    <Data Name="param2">stopped</Data>
    <Binary>4E006500740054006300700041006300740069007600610074006F0072002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:37 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Cryptographic Services service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:37.288554900Z" />
    <EventRecordID>6355</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3300" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Cryptographic Services</Data>
    <Data Name="param2">stopped</Data>
    <Binary>430072007900700074005300760063002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:35 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Intersite Messaging service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:35.806552300Z" />
    <EventRecordID>6354</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3300" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Intersite Messaging</Data>
    <Data Name="param2">stopped</Data>
    <Binary>490073006D0053006500720076002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:35 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Intel(R) Rapid Storage Technology service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:35.759752300Z" />
    <EventRecordID>6353</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3300" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Intel(R) Rapid Storage Technology</Data>
    <Data Name="param2">stopped</Data>
    <Binary>49004100530074006F00720044006100740061004D00670072005300760063002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:35 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Distributed Transaction Coordinator service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:35.525751800Z" />
    <EventRecordID>6352</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3716" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Distributed Transaction Coordinator</Data>
    <Data Name="param2">stopped</Data>
    <Binary>4D0053004400540043002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:35 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The DFS Replication service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:35.385351600Z" />
    <EventRecordID>6351</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3300" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">DFS Replication</Data>
    <Data Name="param2">stopped</Data>
    <Binary>44004600530052002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:35 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Windows Event Log service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:35.354151500Z" />
    <EventRecordID>6350</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3716" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Event Log</Data>
    <Data Name="param2">stopped</Data>
    <Binary>6500760065006E0074006C006F0067002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:34 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Windows Font Cache Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:34.823750600Z" />
    <EventRecordID>6349</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3300" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Font Cache Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>46006F006E007400430061006300680065002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:34 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Diagnostic Policy Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:34.714550400Z" />
    <EventRecordID>6348</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3300" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Diagnostic Policy Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>4400500053002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:34 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The DNS Server service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:34.683350400Z" />
    <EventRecordID>6347</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3300" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">DNS Server</Data>
    <Data Name="param2">stopped</Data>
    <Binary>44004E0053002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:34 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Virtual Disk service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:34.527350100Z" />
    <EventRecordID>6346</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3300" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Virtual Disk</Data>
    <Data Name="param2">stopped</Data>
    <Binary>7600640073002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:34 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The DHCP Client service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:34.184149500Z" />
    <EventRecordID>6345</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3300" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">DHCP Client</Data>
    <Data Name="param2">stopped</Data>
    <Binary>44006800630070002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Dhcp-Client
Date:          4/20/2011 10:50:34 AM
Event ID:      50037
Task Category: Service State Event
Level:         Information
Keywords:      
User:          LOCAL SERVICE
Computer:      big-rig.wtbhome.net
Description:
DHCPv4 client service is stopped. ShutDown Flag value is 1
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Dhcp-Client" Guid="{15A7A4F8-0072-4EAB-ABAD-F98A4D666AED}" />
    <EventID>50037</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>69</Opcode>
    <Keywords>0x2000000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:34.184149500Z" />
    <EventRecordID>6344</EventRecordID>
    <Correlation />
    <Execution ProcessID="928" ThreadID="420" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
    <Data Name="DwordVal">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DHCPv6-Client
Date:          4/20/2011 10:50:34 AM
Event ID:      51047
Task Category: Service State Event
Level:         Information
Keywords:      
User:          LOCAL SERVICE
Computer:      big-rig.wtbhome.net
Description:
DHCPv6 client service is stopped. ShutDown Flag value is 1
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DHCPv6-Client" Guid="{6A1F2B00-6A90-4C38-95A5-5CAB3B056778}" />
    <EventID>51047</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>63</Opcode>
    <Keywords>0x2000000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:34.059349300Z" />
    <EventRecordID>6343</EventRecordID>
    <Correlation />
    <Execution ProcessID="928" ThreadID="376" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
    <Data Name="DwordVal">1</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:34 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Application Host Helper Service service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:34.043749200Z" />
    <EventRecordID>6342</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3716" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Application Host Helper Service</Data>
    <Data Name="param2">stopped</Data>
    <Binary>41007000700048006F00730074005300760063002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:34 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Active Directory Web Services service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:34.028149200Z" />
    <EventRecordID>6341</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3716" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Active Directory Web Services</Data>
    <Data Name="param2">stopped</Data>
    <Binary>41004400570053002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:33 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Group Policy Client service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:33.575748400Z" />
    <EventRecordID>6340</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3300" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Group Policy Client</Data>
    <Data Name="param2">stopped</Data>
    <Binary>670070007300760063002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:33 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Windows Update service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:33.466548200Z" />
    <EventRecordID>6339</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3624" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Update</Data>
    <Data Name="param2">stopped</Data>
    <Binary>770075006100750073006500720076002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WindowsUpdateClient
Date:          4/20/2011 10:50:33 AM
Event ID:      27
Task Category: Windows Update Agent
Level:         Information
Keywords:      State
User:          SYSTEM
Computer:      big-rig.wtbhome.net
Description:
Automatic Updates is now paused.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WindowsUpdateClient" Guid="{945A8954-C147-4ACD-923F-40C45405A658}" />
    <EventID>27</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>16</Opcode>
    <Keywords>0x8000000000000080</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:33.123347600Z" />
    <EventRecordID>6338</EventRecordID>
    <Correlation />
    <Execution ProcessID="976" ThreadID="2628" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
  </EventData>
</Event>

Log Name:      System
Source:        EventLog
Date:          4/20/2011 10:50:34 AM
Event ID:      6006
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Event log service was stopped.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="EventLog" />
    <EventID Qualifiers="32768">6006</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:34.000000000Z" />
    <EventRecordID>6337</EventRecordID>
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Binary>0100000000000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:50:33 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Windows Modules Installer service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:33.060947500Z" />
    <EventRecordID>6336</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3624" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Modules Installer</Data>
    <Data Name="param2">running</Data>
    <Binary>540072007500730074006500640049006E007300740061006C006C00650072002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-Winlogon
Date:          4/20/2011 10:50:31 AM
Event ID:      7002
Task Category: (1102)
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      big-rig.wtbhome.net
Description:
User Logoff Notification for Customer Experience Improvement Program
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" />
    <EventID>7002</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>1102</Task>
    <Opcode>0</Opcode>
    <Keywords>0x2000000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:31.157744200Z" />
    <EventRecordID>6335</EventRecordID>
    <Correlation ActivityID="{2698178D-FDAD-40AE-9D3C-1371703ADC5B}" />
    <Execution ProcessID="504" ThreadID="2368" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="TSId">1</Data>
    <Data Name="UserSid">S-1-5-21-1229272821-746137067-1708537768-500</Data>
  </EventData>
</Event>

Log Name:      System
Source:        USER32
Date:          4/20/2011 10:50:31 AM
Event ID:      1074
Task Category: None
Level:         Information
Keywords:      Classic
User:          WTBHOME\wtbadmin
Computer:      big-rig.wtbhome.net
Description:
The process C:\Windows\system32\winlogon.exe (BIG-RIG) has initiated the restart of computer BIG-RIG on behalf of user WTBHOME\wtbadmin for the following reason: No title for this reason could be found
 Reason Code: 0x500ff
 Shutdown Type: restart
 Comment: 
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="USER32" />
    <EventID Qualifiers="32768">1074</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:31.000000000Z" />
    <EventRecordID>6334</EventRecordID>
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-21-1229272821-746137067-1708537768-500" />
  </System>
  <EventData>
    <Data>C:\Windows\system32\winlogon.exe (BIG-RIG)</Data>
    <Data>BIG-RIG</Data>
    <Data>No title for this reason could be found</Data>
    <Data>0x500ff</Data>
    <Data>restart</Data>
    <Data>
    </Data>
    <Data>WTBHOME\wtbadmin</Data>
    <Binary>FF000500000000000000000000000000000000000000000000000000000000000000000000000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        USER32
Date:          4/20/2011 10:50:27 AM
Event ID:      1074
Task Category: None
Level:         Information
Keywords:      Classic
User:          WTBHOME\wtbadmin
Computer:      big-rig.wtbhome.net
Description:
The process Explorer.EXE has initiated the restart of computer BIG-RIG on behalf of user WTBHOME\wtbadmin for the following reason: Operating System: Reconfiguration (Planned)
 Reason Code: 0x84020004
 Shutdown Type: restart
 Comment: 
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="USER32" />
    <EventID Qualifiers="32768">1074</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:50:27.000000000Z" />
    <EventRecordID>6333</EventRecordID>
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-21-1229272821-746137067-1708537768-500" />
  </System>
  <EventData>
    <Data>Explorer.EXE</Data>
    <Data>BIG-RIG</Data>
    <Data>Operating System: Reconfiguration (Planned)</Data>
    <Data>0x84020004</Data>
    <Data>restart</Data>
    <Data>
    </Data>
    <Data>WTBHOME\wtbadmin</Data>
    <Binary>04000284000000000000000000000000000000000000000000000000000000000000000000000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:33:49 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The WinHTTP Web Proxy Auto-Discovery Service service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:33:49.479984800Z" />
    <EventRecordID>6332</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3912" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">WinHTTP Web Proxy Auto-Discovery Service</Data>
    <Data Name="param2">running</Data>
    <Binary>570069006E0048007400740070004100750074006F00500072006F00780079005300760063002F0034000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:26:27 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Windows Modules Installer service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:26:27.375208300Z" />
    <EventRecordID>6331</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3904" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Modules Installer</Data>
    <Data Name="param2">stopped</Data>
    <Binary>540072007500730074006500640049006E007300740061006C006C00650072002F0031000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:26:26 AM
Event ID:      7040
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      big-rig.wtbhome.net
Description:
The start type of the Windows Modules Installer service was changed from auto start to demand start.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7040</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:26:26.626407000Z" />
    <EventRecordID>6330</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3904" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="param1">Windows Modules Installer</Data>
    <Data Name="param2">auto start</Data>
    <Data Name="param3">demand start</Data>
    <Data Name="param4">TrustedInstaller</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:26:25 AM
Event ID:      7040
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      big-rig.wtbhome.net
Description:
The start type of the Windows Modules Installer service was changed from demand start to auto start.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7040</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:26:25.862005600Z" />
    <EventRecordID>6329</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="3904" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="param1">Windows Modules Installer</Data>
    <Data Name="param2">demand start</Data>
    <Data Name="param3">auto start</Data>
    <Data Name="param4">TrustedInstaller</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Service Control Manager
Date:          4/20/2011 10:16:25 AM
Event ID:      7036
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      big-rig.wtbhome.net
Description:
The Windows Modules Installer service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2011-04-20T14:16:25.806951700Z" />
    <EventRecordID>6328</EventRecordID>
    <Correlation />
    <Execution ProcessID="568" ThreadID="1936" />
    <Channel>System</Channel>
    <Computer>big-rig.wtbhome.net</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Windows Modules Installer</Data>
    <Data Name="param2">running</Data>
    <Binary>540072007500730074006500640049006E007300740061006C006C00650072002F0034000000</Binary>
  </EventData>
</Event>