(EventID:300 TargetUserSid:S\-1\-5\-21\-* (SidList:S\-1\-5\-32\-544* OR SidList:\-500\}* OR SidList:\-518\}* OR SidList:\-519\}*)) (-(TargetUserSid:\-500 OR TargetUserSid:\-518 OR TargetUserSid:\-519))