(EventID:4656 OR EventID:4663 OR EventID:4658) (ObjectName:.AAA OR ObjectName:.ZZZ)