(EventID:4662 ObjectType:bf967aba\-0de6\-11d0\-a285\-00aa003049e2* (AccessMask:1* OR AccessMask:3* OR AccessMask:4* OR AccessMask:7* OR AccessMask:9* OR AccessMask:B* OR AccessMask:D* OR AccessMask:F*)) (-(SubjectUserName:$ OR SubjectUserName:MSOL_*))