(TargetObject:\\SOFTWARE\\Microsoft\\Windows\ NT\\CurrentVersion\\ProfileList\\S\-1\-5\-21\-* TargetObject:\\ProfileImagePath*) (Details:ANONYMOUS* OR Details:_DomainUser_*)