(EventID:5136 OR EventID:5145) ((((AttributeLDAPDisplayName:gPCMachineExtensionNames OR AttributeLDAPDisplayName:gPCUserExtensionNames) AttributeValue:42B5FAAE\-6536\-11D2\-AE5A\-0000F87571E3*) (AttributeValue:40B6664F\-4972\-11D1\-A7CA\-0000F87571E3* OR AttributeValue:40B66650\-4972\-11D1\-A7CA\-0000F87571E3*)) OR (ShareName:\\SYSVOL (RelativeTargetName:\\scripts.ini OR RelativeTargetName:\\psscripts.ini) AccessList:%%4417*))