(EventID:517 Provider_Name:Security) OR (EventID:1102 Provider_Name:Microsoft\-Windows\-Eventlog)