﻿<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<Events>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>148</EventID>
			<Version>0</Version>
			<Level>4</Level>
			<Task>4</Task>
			<Opcode>17</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:16.493997000Z'/>
			<EventRecordID>36314</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='3536'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='ChannelName'>rdplic</Data>
			<Data Name='TunnelID'>0</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>Channel rdplic has been closed between the server and the client on transport tunnel: 0.</Message>
			<Level>Information</Level>
			<Task>RemoteFX module</Task>
			<Opcode>CloseConnection</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>148</EventID>
			<Version>0</Version>
			<Level>4</Level>
			<Task>4</Task>
			<Opcode>17</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:16.493986800Z'/>
			<EventRecordID>36313</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='3536'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='ChannelName'>rdpcmd</Data>
			<Data Name='TunnelID'>0</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>Channel rdpcmd has been closed between the server and the client on transport tunnel: 0.</Message>
			<Level>Information</Level>
			<Task>RemoteFX module</Task>
			<Opcode>CloseConnection</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>148</EventID>
			<Version>0</Version>
			<Level>4</Level>
			<Task>4</Task>
			<Opcode>17</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:16.493975500Z'/>
			<EventRecordID>36312</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='3536'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='ChannelName'>rdpinpt</Data>
			<Data Name='TunnelID'>0</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>Channel rdpinpt has been closed between the server and the client on transport tunnel: 0.</Message>
			<Level>Information</Level>
			<Task>RemoteFX module</Task>
			<Opcode>CloseConnection</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>145</EventID>
			<Version>0</Version>
			<Level>4</Level>
			<Task>4</Task>
			<Opcode>19</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:16.493957100Z'/>
			<EventRecordID>36311</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='3536'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='IdleSeconds'>0</Data>
			<Data Name='IdleSeconds1'>0</Data>
			<Data Name='IdleSeconds2'>0</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>During this connection, server has not sent data or graphics update for 0 seconds (Idle1: 0, Idle2: 0).</Message>
			<Level>Information</Level>
			<Task>RemoteFX module</Task>
			<Opcode>Runtime</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>102</EventID>
			<Version>0</Version>
			<Level>4</Level>
			<Task>4</Task>
			<Opcode>17</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:16.493948600Z'/>
			<EventRecordID>36310</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='3536'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData/>
		<RenderingInfo Culture='de-DE'>
			<Message>The server has terminated main RDP connection with the client.</Message>
			<Level>Information</Level>
			<Task>RemoteFX module</Task>
			<Opcode>CloseConnection</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>72</EventID>
			<Version>0</Version>
			<Level>4</Level>
			<Task>4</Task>
			<Opcode>13</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:16.493892700Z'/>
			<EventRecordID>36309</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='3536'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='MethodName'>OnDisconnected(server initiated)</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>Interface method called: OnDisconnected(server initiated)</Message>
			<Level>Information</Level>
			<Task>RemoteFX module</Task>
			<Opcode>RCMProtocolImpl</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>226</EventID>
			<Version>0</Version>
			<Level>3</Level>
			<Task>4</Task>
			<Opcode>19</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:16.493351800Z'/>
			<EventRecordID>36308</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='2580'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='StateTransition'>RDP_TCP</Data>
			<Data Name='PreviousState'>23</Data>
			<Data Name='PreviousStateName'>StateUnknown</Data>
			<Data Name='NewState'>21</Data>
			<Data Name='NewStateName'>StateDisconnected</Data>
			<Data Name='Event'>43</Data>
			<Data Name='EventName'>Event_Disconnect</Data>
			<Data Name='ErrorCode'>0x80070040</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>RDP_TCP: An error was encountered when transitioning from StateUnknown in response to Event_Disconnect (error code 0x80070040).</Message>
			<Level>Warning</Level>
			<Task>RemoteFX module</Task>
			<Opcode>Runtime</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>142</EventID>
			<Version>0</Version>
			<Level>3</Level>
			<Task>4</Task>
			<Opcode>15</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:16.493297200Z'/>
			<EventRecordID>36307</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='2580'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='error'>64</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>TCP socket READ operation failed, error 64</Message>
			<Level>Warning</Level>
			<Task>RemoteFX module</Task>
			<Opcode>EstablishConnection</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>103</EventID>
			<Version>0</Version>
			<Level>4</Level>
			<Task>4</Task>
			<Opcode>17</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:16.422328800Z'/>
			<EventRecordID>36306</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='908'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='ReasonCode'>257</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>The disconnect reason is 257</Message>
			<Level>Information</Level>
			<Task>RemoteFX module</Task>
			<Opcode>CloseConnection</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>72</EventID>
			<Version>0</Version>
			<Level>4</Level>
			<Task>4</Task>
			<Opcode>13</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:16.422021000Z'/>
			<EventRecordID>36305</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='908'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='MethodName'>SendLogonErrorInfoToClient(WinlogonStatus: 0x80070057, ClientError: 0xffffffff)</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>Interface method called: SendLogonErrorInfoToClient(WinlogonStatus: 0x80070057, ClientError: 0xffffffff)</Message>
			<Level>Information</Level>
			<Task>RemoteFX module</Task>
			<Opcode>RCMProtocolImpl</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>72</EventID>
			<Version>0</Version>
			<Level>4</Level>
			<Task>4</Task>
			<Opcode>13</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:16.421995800Z'/>
			<EventRecordID>36304</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='908'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='MethodName'>SetErrorInfo(0x101)</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>Interface method called: SetErrorInfo(0x101)</Message>
			<Level>Information</Level>
			<Task>RemoteFX module</Task>
			<Opcode>RCMProtocolImpl</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>227</EventID>
			<Version>0</Version>
			<Level>2</Level>
			<Task>4</Task>
			<Opcode>19</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:16.421982700Z'/>
			<EventRecordID>36303</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='908'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='Name'>CUMRDPConnection</Data>
			<Data Name='Value'>2147942487</Data>
			<Data Name='CustomLevel'>'SendClientLicense failed!' in CUMRDPConnection::SendClientLicense at 3839 err=[0x80070057]</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>'SendClientLicense failed!' in CUMRDPConnection::SendClientLicense at 3839 err=[0x80070057]</Message>
			<Level>Error</Level>
			<Task>RemoteFX module</Task>
			<Opcode>Runtime</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>72</EventID>
			<Version>0</Version>
			<Level>4</Level>
			<Task>4</Task>
			<Opcode>13</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:16.421972400Z'/>
			<EventRecordID>36302</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='908'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='MethodName'>SendClientLicense</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>Interface method called: SendClientLicense</Message>
			<Level>Information</Level>
			<Task>RemoteFX module</Task>
			<Opcode>RCMProtocolImpl</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>72</EventID>
			<Version>0</Version>
			<Level>4</Level>
			<Task>4</Task>
			<Opcode>13</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:16.421590900Z'/>
			<EventRecordID>36301</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='908'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='MethodName'>GetSecurityFilterCreds</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>Interface method called: GetSecurityFilterCreds</Message>
			<Level>Information</Level>
			<Task>RemoteFX module</Task>
			<Opcode>RCMProtocolImpl</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>227</EventID>
			<Version>0</Version>
			<Level>2</Level>
			<Task>4</Task>
			<Opcode>19</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:16.421582000Z'/>
			<EventRecordID>36300</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='908'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='Name'>CUMRDPConnection</Data>
			<Data Name='Value'>2147500033</Data>
			<Data Name='CustomLevel'>'Failed GetConnectionProperty' in CUMRDPConnection::QueryProperty at 2884 err=[0x80004001]</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>'Failed GetConnectionProperty' in CUMRDPConnection::QueryProperty at 2884 err=[0x80004001]</Message>
			<Level>Error</Level>
			<Task>RemoteFX module</Task>
			<Opcode>Runtime</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>71</EventID>
			<Version>0</Version>
			<Level>4</Level>
			<Task>4</Task>
			<Opcode>13</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:16.421558700Z'/>
			<EventRecordID>36299</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='908'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='ConnectionName'>RDP-Tcp#26</Data>
			<Data Name='DisplayDriverName'>RDPUDD</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>The connection RDP-Tcp#26 uses display driver RDPUDD.</Message>
			<Level>Information</Level>
			<Task>RemoteFX module</Task>
			<Opcode>RCMProtocolImpl</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>104</EventID>
			<Version>0</Version>
			<Level>4</Level>
			<Task>4</Task>
			<Opcode>15</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:16.421550300Z'/>
			<EventRecordID>36298</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='908'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='TimezoneBiasHour'>[1]</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>Client timezone is [1] hour from UTC; </Message>
			<Level>Information</Level>
			<Task>RemoteFX module</Task>
			<Opcode>EstablishConnection</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>72</EventID>
			<Version>0</Version>
			<Level>4</Level>
			<Task>4</Task>
			<Opcode>13</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:16.421485400Z'/>
			<EventRecordID>36297</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='908'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='MethodName'>AcceptConnection</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>Interface method called: AcceptConnection</Message>
			<Level>Information</Level>
			<Task>RemoteFX module</Task>
			<Opcode>RCMProtocolImpl</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>72</EventID>
			<Version>0</Version>
			<Level>4</Level>
			<Task>4</Task>
			<Opcode>13</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:16.421460100Z'/>
			<EventRecordID>36296</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='1216'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='MethodName'>OnStartLicensing</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>Interface method called: OnStartLicensing</Message>
			<Level>Information</Level>
			<Task>RemoteFX module</Task>
			<Opcode>RCMProtocolImpl</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>132</EventID>
			<Version>0</Version>
			<Level>4</Level>
			<Task>4</Task>
			<Opcode>15</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:16.421445300Z'/>
			<EventRecordID>36295</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='1216'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='ChannelName'>rdpcmd</Data>
			<Data Name='TunnelID'>0</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>A channel rdpcmd has been connected between the server and the client using transport tunnel: 0.</Message>
			<Level>Information</Level>
			<Task>RemoteFX module</Task>
			<Opcode>EstablishConnection</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>132</EventID>
			<Version>0</Version>
			<Level>4</Level>
			<Task>4</Task>
			<Opcode>15</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:16.421436200Z'/>
			<EventRecordID>36294</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='1216'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='ChannelName'>rdplic</Data>
			<Data Name='TunnelID'>0</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>A channel rdplic has been connected between the server and the client using transport tunnel: 0.</Message>
			<Level>Information</Level>
			<Task>RemoteFX module</Task>
			<Opcode>EstablishConnection</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>101</EventID>
			<Version>0</Version>
			<Level>3</Level>
			<Task>4</Task>
			<Opcode>16</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:16.421413400Z'/>
			<EventRecordID>36293</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='1216'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='ReasonString'>Reason Code: 2(Server Configuration).</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>The network characteristics detection function has been disabled because of Reason Code: 2(Server Configuration)..</Message>
			<Level>Warning</Level>
			<Task>RemoteFX module</Task>
			<Opcode>NetworkDetect</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>141</EventID>
			<Version>0</Version>
			<Level>4</Level>
			<Task>4</Task>
			<Opcode>11</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:00.820776700Z'/>
			<EventRecordID>36292</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='908'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='InstanceID'>26</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>PerfCounter session started with instance ID 26</Message>
			<Level>Information</Level>
			<Task>RemoteFX module</Task>
			<Opcode>Initialize</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>72</EventID>
			<Version>0</Version>
			<Level>4</Level>
			<Task>4</Task>
			<Opcode>13</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:00.819868200Z'/>
			<EventRecordID>36291</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='908'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='MethodName'>SendPolicyData</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>Interface method called: SendPolicyData</Message>
			<Level>Information</Level>
			<Task>RemoteFX module</Task>
			<Opcode>RCMProtocolImpl</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>72</EventID>
			<Version>0</Version>
			<Level>4</Level>
			<Task>4</Task>
			<Opcode>13</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:00.819854600Z'/>
			<EventRecordID>36290</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='908'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='MethodName'>PrepareForAccept</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>Interface method called: PrepareForAccept</Message>
			<Level>Information</Level>
			<Task>RemoteFX module</Task>
			<Opcode>RCMProtocolImpl</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>65</EventID>
			<Version>0</Version>
			<Level>4</Level>
			<Task>4</Task>
			<Opcode>13</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:00.817303600Z'/>
			<EventRecordID>36289</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='3544'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='ConnectionName'>RDP-Tcp#26</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>Connection RDP-Tcp#26 created </Message>
			<Level>Information</Level>
			<Task>RemoteFX module</Task>
			<Opcode>RCMProtocolImpl</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
	<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
		<System>
			<Provider Name='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS' Guid='{1139c61b-b549-4251-8ed3-27250a1edec8}'/>
			<EventID>131</EventID>
			<Version>0</Version>
			<Level>4</Level>
			<Task>4</Task>
			<Opcode>15</Opcode>
			<Keywords>0x4000000000000000</Keywords>
			<TimeCreated SystemTime='2022-10-11T06:33:00.815265200Z'/>
			<EventRecordID>36288</EventRecordID>
			<Correlation ActivityID='{f420dff6-42e3-4368-9081-504662120000}'/>
			<Execution ProcessID='372' ThreadID='3648'/>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Computer>ServerC.our.domain.com</Computer>
			<Security UserID='S-1-5-20'/>
		</System>
		<EventData>
			<Data Name='ConnType'>TCP</Data>
			<Data Name='ClientIP'>10.XX.XX.ServerB:55668</Data>
		</EventData>
		<RenderingInfo Culture='de-DE'>
			<Message>The server accepted a new TCP connection from client 10.XX.XX.ServerB:55668.</Message>
			<Level>Information</Level>
			<Task>RemoteFX module</Task>
			<Opcode>EstablishConnection</Opcode>
			<Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
			<Provider/>
			<Keywords/>
		</RenderingInfo>
	</Event>
</Events>