<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" />
<EventID>7001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>1101</Task>
<Opcode>0</Opcode>
<Keywords>0x2000000000000000</Keywords>
<TimeCreated SystemTime="2015-06-15T05:28:45.104252900Z" />
<EventRecordID>132047</EventRecordID>
<Correlation />
<Execution ProcessID="22364" ThreadID="13356" />
<Channel>System</Channel>
<Computer>motoliz</Computer>
<Security UserID="S-1-5-18" />
</System>
- <EventData>
<Data Name="TSId">3</Data>
<Data Name="UserSid">S-1-5-21-1074912821-2115248367-476593426-1055</Data>
</EventData>
</Event>








- System

- Provider

[ Name] Microsoft-Windows-Winlogon
[ Guid] {DBE9B383-7CF3-4331-91CC-A3CB16A3B538}

EventID 7001

Version 0

Level 4

Task 1101

Opcode 0

Keywords 0x2000000000000000

- TimeCreated

[ SystemTime] 2015-06-15T05:28:45.104252900Z

EventRecordID 132047

Correlation

- Execution

[ ProcessID] 22364
[ ThreadID] 13356

Channel System

Computer motoliz

- Security

[ UserID] S-1-5-18


- EventData

TSId 3
UserSid S-1-5-21-1074912821-2115248367-476593426-1055