(EventID:400 HasFullTrust:TRUE) (-((PackageSourceUri:file\:\/\/\/C\:\/Program%20Files\/* OR PackageSourceUri:file\:\/\/\/C\:\/Program%20Files%20\(x86\)\/*) OR (PackageSourceUri:https\:\/\/go.microsoft.com\/fwlink\/*linkid* OR (PackageSourceUri:.cdn.microsoft.com* OR PackageSourceUri:.cdn.office.net\/*)) OR (CallingProcess:sysprep.exe* OR CallingProcess:svchost.exe,AppReadiness*))) (-(PackageSourceUri:x\-windowsupdate\:\/\/* OR PackageFullName:MicrosoftWindows.Client.*))