Edit C:\Windows\System32\wdi\perftrack\WinlogonEvents.ptxml

<?xml version='1.0' encoding='utf-8' standalone='yes'?>
<?Copyright (c) Microsoft Corporation. All rights reserved.?>
<instrumentationManifest>
  <instrumentation>
    <perftrack>
      <scenario guid="{fad19cc3-fa93-4252-a7f0-6464a43c6603}" interactionclass="Extended" key="$Global" name="PerfTrack-SystemBoot" sqmid="484" tags="Boot">
        <event provider="{96ac7637-5950-4a30-b8f7-e07e8e5734c1}" type="start" value="501" version="0"/>
        <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="stop" value="5007" version="0"/>
      </scenario>
      <scenario guid="{2db718c3-7f85-4fe2-a366-fe8c8ac40fe9}" interactionclass="Extended" key="$ProcessId" name="PerfTrack-BootLogon" sqmid="485" tags="Boot">
        <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="start" value="5001" version="0"/>
        <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="stop" value="5005" version="0"/>
      </scenario>
      <scenario digestedmetadata="@Status,0,0,0,8,1,4,4" guid="{d585d0d4-5680-4912-84f1-5478a5611d3e}" interactionclass="Responsive" key="$ProcessId" metadata="Status" name="WinLogon-UnlockEnterCredentialsToFailCredentials" sqmdatapointid="7698" sqmid="1182" tags="Winlogon">
        <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="start" value="6105" version="0"/>
        <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="stop" value="6107" version="0"/>
      </scenario>
      <scenario guid="{1c83e153-e15c-4eaa-8c95-cb180ab21c48}" interactionclass="Responsive" key="$ProcessId" name="WinLogon-UnlockEnterCredentialsToSwitchDesktop" sqmid="1179" tags="WinLogon">
        <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="start" value="6105" version="0"/>
        <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="stop" value="6106" version="0"/>
      </scenario>
      <scenario digestedmetadata="@LogoffFlags,0,0,0,8,1,4,4" guid="{9e6c0179-34ba-48c1-8aee-a200ca145e69}" interactionclass="Extended" key="$ProcessId" metadata="LogoffFlags" name="WinLogon-LogoffAppsTerminationToSessionEnd" sqmdatapointid="7698" sqmid="1178" tags="WinLogon">
        <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="start" value="6103" version="0"/>
        <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="stop" value="6104" version="0"/>
      </scenario>
      <scenario guid="{1bfb53db-db44-49fc-9298-34d6d2a769c7}" interactionclass="Continuous" key="$ProcessId" name="WinLogon-LogoffRequestToUserFeedback" sqmid="1177" tags="WinLogon">
        <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="start" value="6101" version="0"/>
        <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="stop" value="6102" version="0"/>
      </scenario>
      <scenario guid="{f26165b1-7f60-4643-918e-4820667219dc}" interactionclass="Extended" key="$ProcessId" name="WinLogon-FirstLogonEnterCredentialsToUserDesktop" sqmid="1186" tags="WinLogon">
        <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="start" value="6108" version="0"/>
        <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="stop" value="6111" version="0"/>
      </scenario>
      <scenario guid="{e880875f-7a62-4221-9e7b-5662b35d8475}" interactionclass="Continuous" key="$ProcessId" name="WinLogon-NthLogonEnterCredentialsToUserDesktop" sqmid="1185" tags="WinLogon">
        <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="start" value="6108" version="0"/>
        <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="stop" value="6112" version="0"/>
      </scenario>
      <scenario digestedmetadata="@Status,0,0,0,8,1,4,4" guid="{9efced9d-f21f-4d81-97aa-371918703eb8}" interactionclass="Responsive" key="$ProcessId" metadata="Status" name="WinLogon-LogonEnterCredentialsToFailCredentials" sqmdatapointid="7698" sqmid="1184" tags="WinLogon">
        <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="start" value="6108" version="0"/>
        <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="stop" value="6109" version="0"/>
      </scenario>
      <scenario guid="{64203c3a-2ac2-403c-b0ec-7939e92922ad}" interactionclass="Responsive" key="$ProcessId" name="WinLogon-LogonCancel" sqmid="1187" tags="WinLogon">
        <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="start" value="6108" version="0"/>
        <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="stop" value="6110" version="0"/>
      </scenario>
      <scenario guid="{c655d0bd-e1fd-42a1-a59f-d5a228c4a63b}" interactionclass="Responsive" key="$Global" name="WinLogon-LockRequestReceivedToLockScreen" sqmid="1183" tags="WinLogon">
        <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="start" value="6113" version="0"/>
        <event provider="{63D2BB1D-E39A-41b8-9A3D-52DD06677588}" type="stop" value="25096" version="0"/>
      </scenario>
      <scenario guid="{4e12f634-eac4-4939-9a8f-616717fd260b}" interactionclass="Typical" key="$ProcessId" name="WinLogon-LockRequestReceivedToCADScreen" sqmid="1188" tags="WinLogon">
        <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="start" value="6113" version="0"/>
        <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="stop" value="6114" version="0"/>
      </scenario>
      <scenario digestedmetadata="@Duration,0,0,0,8,1,4,4 @ResolverData,0,0,4,8,1,4,4" guid="{6f9aedf8-8552-4406-9dbe-50d7d204a184}" interactionclass="Custom" metadata="Duration,ResolverData" name="WinLogon-LogoffRequestToSessionEnd" sqmdatapointid="7698" sqmid="1272" tags="WinLogon">
        <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="trigger" value="6116" version="0"/>
      </scenario>
      <scenario guid="{17700074-6c50-47e1-825f-7231751be3cf}" interactionclass="Typical" key="$ProcessId" name="WinLogon-LockRequestReceivedToCancel" sqmid="1271" tags="WinLogon">
        <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="start" value="6113" version="0"/>
        <event provider="{dbe9b383-7cf3-4331-91cc-a3cb16a3b538}" type="stop" value="6115" version="0"/>
      </scenario>
    </perftrack>
  </instrumentation>
</instrumentationManifest>

Ms-Dos/Windows Unix Write backup

jsp File Browser version 1.2 by www.vonloesch.de