((EventID:141 OR EventID:142) (TaskName:\\Windows\\SystemRestore\\SR* OR TaskName:\\Windows\\Windows\ Defender\\* OR TaskName:\\Windows\\BitLocker* OR TaskName:\\Windows\\WindowsBackup\\* OR TaskName:\\Windows\\WindowsUpdate\\* OR TaskName:\\Windows\\UpdateOrchestrator\\* OR TaskName:\\Windows\\ExploitGuard*)) (-(UserName:AUTHORI* OR UserName:AUTORI*))