(EventID:4768 TargetUserName:$ CertThumbprint:) (-(IpAddress:\:\:1 OR CertThumbprint:))