((EventID:5861 ("ActiveScriptEventConsumer" OR "CommandLineEventConsumer" OR "CommandLineTemplate")) OR EventID:5859) (-(Provider:SCM\ Event\ Provider Query:select\ *\ from\ MSFT_SCMEventLogEvent User:S\-1\-5\-32\-544 PossibleCause:Permanent))