((EventID:4625 OR EventID:4776) ((Status:0xC0000072 OR Status:0xC000006F OR Status:0xC0000070 OR Status:0xC0000413 OR Status:0xC000018C OR Status:0xC000015B) OR (SubStatus:0xC0000072 OR SubStatus:0xC000006F OR SubStatus:0xC0000070 OR SubStatus:0xC0000413 OR SubStatus:0xC000018C OR SubStatus:0xC000015B))) (-SubjectUserSid:S\-1\-0\-0)