Microsoft\Windows\Ras\MobilityManager
D:P(A;;FA;;;BA)(A;;FA;;;SY)(A;;FR;;;LS)
$(@%SystemRoot%\system32\rasmbmgr.dll,-201)
$(@%SystemRoot%\system32\rasmbmgr.dll,-202)
true
<QueryList>
<Query
Id="0"
Path="Application"
>
<Select Path="Application">*[System[Provider[@Name='RasClient'] and (Level=4 or Level=0) and (EventID=20281)]]</Select>
</Query>
</QueryList>
S-1-5-19
{c463a0fc-794f-4fdf-9201-01938ceacafa}
true
Parallel
true
false
false
true