(EventID:4662 AccessMask:0x100 (Properties:1131f6aa\-9c07\-11d1\-f79f\-00c04fc2dcd2* OR Properties:1131f6ad\-9c07\-11d1\-f79f\-00c04fc2dcd2* OR Properties:89e95b76\-444d\-4c62\-991a\-0facbeda640c*)) (-(SubjectUserName:$ OR SubjectUserName:MSOL_*))