Microsoft\Windows\Ras\MobilityManager D:P(A;;FA;;;BA)(A;;FA;;;SY)(A;;FR;;;LS) $(@%SystemRoot%\system32\rasmbmgr.dll,-201) $(@%SystemRoot%\system32\rasmbmgr.dll,-202) true <QueryList> <Query Id="0" Path="Application" > <Select Path="Application">*[System[Provider[@Name='RasClient'] and (Level=4 or Level=0) and (EventID=20281)]]</Select> </Query> </QueryList> S-1-5-19 {c463a0fc-794f-4fdf-9201-01938ceacafa} true Parallel true false false true