Received From: (SYSTEMNAME) IP Address->WinEvtLog Rule: 18117 fired (level 7) -> "Windows is shutting down." Portion of the log(s):
WinEvtLog: Security: AUDIT_SUCCESS(5136): Microsoft-Windows-Security- Auditing: (no user): no domain: neptune.bio.anl.gov: A directory service object was modified. Subject: Security ID: S-1-5-21-1343024091-70663838326-725345543-9710 Account Name: SYSTEMNAME $ Account Domain: BIO Logon ID: 0x1ed24d40 Directory Service: Name: bio.anl.gov Type: %%14676 Object: DN: cn=SMS-MP-XXX- SYTEMNAME,CN=System
