(EventID:4662 (Properties:Replicating\ Directory\ Changes\ All* OR Properties:1131f6ad\-9c07\-11d1\-f79f\-00c04fc2dcd2* OR Properties:1131f6aa\-9c07\-11d1\-f79f\-00c04fc2dcd2* OR Properties:9923a32a\-3607\-11d2\-b9be\-0000f87a36b2* OR Properties:89e95b76\-444d\-4c62\-991a\-0facbeda640c*) AccessMask:0x100) (-(SubjectDomainName:Window\ Manager OR (SubjectUserName:NT\ AUT* OR SubjectUserName:MSOL_*) OR SubjectUserName:$))