(EventID:5136 (AttributeLDAPDisplayName:gPCMachineExtensionNames OR AttributeLDAPDisplayName:gPCUserExtensionNames) (AttributeValue:CAB54552\-DEEA\-4691\-817E\-ED4A4D1AFC72* OR AttributeValue:AADCED64\-746C\-4633\-A97C\-D61349046527*)) OR (EventID:5145 ShareName:\\SYSVOL RelativeTargetName:ScheduledTasks.xml (AccessList:WriteData* OR AccessList:%%4417*))