(EventType:DeleteValue TargetObject:\\Microsoft\\Terminal\ Server\ Client\\Default\\MRU*) OR (EventType:DeleteKey TargetObject:\\Microsoft\\Terminal\ Server\ Client\\Servers\\*)