Log Name:      Application
Source:        Microsoft-Windows-Search
Date:          6/2/2022 8:58:05 AM
Event ID:      10024
Task Category: Gatherer
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      dunx1
Description:
The filter host process 20240 did not respond and is being forcibly terminated. 

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
    <EventID Qualifiers="32768">10024</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2022-06-02T12:58:05.6309516Z" />
    <EventRecordID>10844</EventRecordID>
    <Correlation />
    <Execution ProcessID="14760" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>dunx1</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ExtraInfo">
    </Data>
    <Data Name="FilterHostProcessID">20240</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DistributedCOM
Date:          6/2/2022 8:57:18 AM
Event ID:      10016
Task Category: None
Level:         Warning
Keywords:      Classic
User:          DUNX1\runle
Computer:      dunx1
Description:
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user dunx1\runle SID (S-1-5-21-3465743884-2908752811-2602381911-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
    <EventID Qualifiers="0">10016</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2022-06-02T12:57:18.1560043Z" />
    <EventRecordID>94644</EventRecordID>
    <Correlation ActivityID="{81a0754b-5f73-4c65-830b-f50e9461affa}" />
    <Execution ProcessID="1372" ThreadID="14812" />
    <Channel>System</Channel>
    <Computer>dunx1</Computer>
    <Security UserID="S-1-5-21-3465743884-2908752811-2602381911-1001" />
  </System>
  <EventData>
    <Data Name="param1">application-specific</Data>
    <Data Name="param2">Local</Data>
    <Data Name="param3">Activation</Data>
    <Data Name="param4">{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}</Data>
    <Data Name="param5">{15C20B67-12E7-4BB6-92BB-7AFF07997402}</Data>
    <Data Name="param6">dunx1</Data>
    <Data Name="param7">runle</Data>
    <Data Name="param8">S-1-5-21-3465743884-2908752811-2602381911-1001</Data>
    <Data Name="param9">LocalHost (Using LRPC)</Data>
    <Data Name="param10">Unavailable</Data>
    <Data Name="param11">Unavailable</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DistributedCOM
Date:          6/2/2022 8:57:17 AM
Event ID:      10016
Task Category: None
Level:         Warning
Keywords:      Classic
User:          DUNX1\runle
Computer:      dunx1
Description:
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}
 and APPID 
{15C20B67-12E7-4BB6-92BB-7AFF07997402}
 to the user dunx1\runle SID (S-1-5-21-3465743884-2908752811-2602381911-1001) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
    <EventID Qualifiers="0">10016</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2022-06-02T12:57:17.9244842Z" />
    <EventRecordID>94642</EventRecordID>
    <Correlation ActivityID="{1514b864-87ac-4f62-a240-9e31f5707fff}" />
    <Execution ProcessID="1372" ThreadID="14812" />
    <Channel>System</Channel>
    <Computer>dunx1</Computer>
    <Security UserID="S-1-5-21-3465743884-2908752811-2602381911-1001" />
  </System>
  <EventData>
    <Data Name="param1">application-specific</Data>
    <Data Name="param2">Local</Data>
    <Data Name="param3">Activation</Data>
    <Data Name="param4">{2593F8B9-4EAF-457C-B68A-50F6B8EA6B54}</Data>
    <Data Name="param5">{15C20B67-12E7-4BB6-92BB-7AFF07997402}</Data>
    <Data Name="param6">dunx1</Data>
    <Data Name="param7">runle</Data>
    <Data Name="param8">S-1-5-21-3465743884-2908752811-2602381911-1001</Data>
    <Data Name="param9">LocalHost (Using LRPC)</Data>
    <Data Name="param10">Unavailable</Data>
    <Data Name="param11">Unavailable</Data>
  </EventData>
</Event>

Log Name:      Microsoft-Windows-Kernel-EventTracing/Admin
Source:        Microsoft-Windows-Kernel-EventTracing
Date:          6/2/2022 8:46:44 AM
Event ID:      3
Task Category: Session
Level:         Error
Keywords:      Session
User:          SYSTEM
Computer:      dunx1
Description:
Session "PerfDiag Logger" stopped due to the following error: 0xC0000188
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{b675ec37-bdb6-4648-bc92-f3fdc74d3ca2}" />
    <EventID>3</EventID>
    <Version>1</Version>
    <Level>2</Level>
    <Task>2</Task>
    <Opcode>14</Opcode>
    <Keywords>0x8000000000000010</Keywords>
    <TimeCreated SystemTime="2022-06-02T12:46:44.5763694Z" />
    <EventRecordID>125</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="5248" />
    <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
    <Computer>dunx1</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="SessionName">PerfDiag Logger</Data>
    <Data Name="FileName">C:\Windows\system32\WDI\LogFiles\ShutdownPerfDiagLogger.etl</Data>
    <Data Name="ErrorCode">3221225864</Data>
    <Data Name="LoggingMode">41943168</Data>
    <Data Name="FailureReason">0</Data>
  </EventData>
</Event>

Log Name:      Microsoft-Windows-Kernel-EventTracing/Admin
Source:        Microsoft-Windows-Kernel-EventTracing
Date:          6/2/2022 8:46:44 AM
Event ID:      4
Task Category: Logging
Level:         Warning
Keywords:      Session
User:          SYSTEM
Computer:      dunx1
Description:
The maximum file size for session "PerfDiag Logger" has been reached. As a result, events might be lost (not logged) to file "C:\Windows\system32\WDI\LogFiles\ShutdownPerfDiagLogger.etl". The maximum files size is currently set to 20971520 bytes.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{b675ec37-bdb6-4648-bc92-f3fdc74d3ca2}" />
    <EventID>4</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>1</Task>
    <Opcode>10</Opcode>
    <Keywords>0x8000000000000010</Keywords>
    <TimeCreated SystemTime="2022-06-02T12:46:44.5763661Z" />
    <EventRecordID>124</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="5248" />
    <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
    <Computer>dunx1</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="SessionName">PerfDiag Logger</Data>
    <Data Name="FileName">C:\Windows\system32\WDI\LogFiles\ShutdownPerfDiagLogger.etl</Data>
    <Data Name="ErrorCode">3221225864</Data>
    <Data Name="LoggingMode">41943168</Data>
    <Data Name="MaxFileSize">20971520</Data>
  </EventData>
</Event>

Log Name:      Application
Source:        VSS
Date:          6/2/2022 8:38:09 AM
Event ID:      8194
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      dunx1
Description:
Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
. This is often caused by incorrect security settings in either the writer or requestor process. 

Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {0a3fd91e-2858-4287-84a0-f02420e75295}
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="VSS" />
    <EventID Qualifiers="0">8194</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2022-06-02T12:38:09.6340238Z" />
    <EventRecordID>10838</EventRecordID>
    <Correlation />
    <Execution ProcessID="5264" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>dunx1</Computer>
    <Security />
  </System>
  <EventData>
    <Data>0x80070005, Access is denied.
</Data>
    <Data>

Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {0a3fd91e-2858-4287-84a0-f02420e75295}</Data>
    <Binary>2D20436F64653A20575254575254494330303030313238372D2043616C6C3A20575254575254494330303030313234312D205049443A202030303030353236342D205449443A202030303030353637362D20434D443A2020433A5C57696E646F77735C73797374656D33325C737663686F73742E657865202D6B204E6574776F726B53657276696365202D70202020202D20557365723A204E616D653A204E5420415554484F524954595C4E4554574F524B20534552564943452C205349443A532D312D352D3230</Binary>
  </EventData>
</Event>

Log Name:      Application
Source:        VSS
Date:          6/2/2022 8:24:55 AM
Event ID:      8194
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      dunx1
Description:
Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
. This is often caused by incorrect security settings in either the writer or requestor process. 

Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {0a3fd91e-2858-4287-84a0-f02420e75295}
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="VSS" />
    <EventID Qualifiers="0">8194</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2022-06-02T12:24:55.9032964Z" />
    <EventRecordID>10805</EventRecordID>
    <Correlation />
    <Execution ProcessID="5264" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>dunx1</Computer>
    <Security />
  </System>
  <EventData>
    <Data>0x80070005, Access is denied.
</Data>
    <Data>

Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {0a3fd91e-2858-4287-84a0-f02420e75295}</Data>
    <Binary>2D20436F64653A20575254575254494330303030313238372D2043616C6C3A20575254575254494330303030313234312D205049443A202030303030353236342D205449443A202030303031313834302D20434D443A2020433A5C57696E646F77735C73797374656D33325C737663686F73742E657865202D6B204E6574776F726B53657276696365202D70202020202D20557365723A204E616D653A204E5420415554484F524954595C4E4554574F524B20534552564943452C205349443A532D312D352D3230</Binary>
  </EventData>
</Event>

Log Name:      Microsoft-Windows-User Device Registration/Admin
Source:        Microsoft-Windows-User Device Registration
Date:          6/2/2022 8:24:16 AM
Event ID:      360
Task Category: None
Level:         Warning
Keywords:      
User:          DUNX1\runle
Computer:      dunx1
Description:
Windows Hello for Business provisioning will not be launched. 
Device is AAD joined ( AADJ or DJ++ ): Not Tested 
User has logged on with AAD credentials: No 
Windows Hello for Business policy is enabled: Not Tested 
Windows Hello for Business post-logon provisioning is enabled: Not Tested 
Local computer meets Windows hello for business hardware requirements: Not Tested 
User is not connected to the machine via Remote Desktop: Yes 
User certificate for on premise auth policy is enabled: Not Tested 
Machine is governed by none policy. 
Cloud trust for on premise auth policy is enabled: Not Tested 
User account has Cloud TGT: Not Tested 
See https://go.microsoft.com/fwlink/?linkid=832647 for more details.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-User Device Registration" Guid="{23b8d46b-67dd-40a3-b636-d43e50552c6d}" />
    <EventID>360</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2022-06-02T12:24:16.4773532Z" />
    <EventRecordID>62</EventRecordID>
    <Correlation />
    <Execution ProcessID="15412" ThreadID="8128" />
    <Channel>Microsoft-Windows-User Device Registration/Admin</Channel>
    <Computer>dunx1</Computer>
    <Security UserID="S-1-5-21-3465743884-2908752811-2602381911-1001" />
  </System>
  <EventData>
    <Data Name="Message">Windows Hello for Business provisioning will not be launched.</Data>
    <Data Name="DeviceIsJoined">Not Tested</Data>
    <Data Name="AADPrt">No</Data>
    <Data Name="NgcPolicyEnabled">Not Tested</Data>
    <Data Name="NgcPostLogonProvisioningEnabled">Not Tested</Data>
    <Data Name="NgcHardwarePolicyMet">Not Tested</Data>
    <Data Name="UserIsRemote">Yes</Data>
    <Data Name="LogonCertRequired">Not Tested</Data>
    <Data Name="MachinePolicySource">none</Data>
    <Data Name="UseCloudTrust">Not Tested</Data>
    <Data Name="CloudTgt">Not Tested</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Server
Date:          6/2/2022 8:24:15 AM
Event ID:      2505
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      dunx1
Description:
The server could not bind to the transport \Device\NetBT_Tcpip_{A4CD1237-8044-4F00-A723-77B1F058E076} because another computer on the network has the same name.  The server could not start.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Server" />
    <EventID Qualifiers="49152">2505</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2022-06-02T12:24:15.8397475Z" />
    <EventRecordID>93751</EventRecordID>
    <Correlation />
    <Execution ProcessID="6092" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>dunx1</Computer>
    <Security />
  </System>
  <EventData>
    <Data>\Device\NetBT_Tcpip_{A4CD1237-8044-4F00-A723-77B1F058E076}</Data>
    <Binary>34000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Netwtw10
Date:          6/2/2022 8:24:13 AM
Event ID:      6062
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      dunx1
Description:
The description for Event ID 6062 from source Netwtw10 cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event: 

\Device\NDMP1
Intel(R) Wi-Fi 6E AX211 160MHz

The system cannot find the file specified

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Netwtw10" />
    <EventID Qualifiers="32768">6062</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2022-06-02T12:24:13.9457543Z" />
    <EventRecordID>93750</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="14664" />
    <Channel>System</Channel>
    <Computer>dunx1</Computer>
    <Security />
  </System>
  <EventData>
    <Data>\Device\NDMP1</Data>
    <Data>Intel(R) Wi-Fi 6E AX211 160MHz</Data>
    <Binary>000000000200300000000000AE170080000000000000000000000000000000000000000000000000</Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DistributedCOM
Date:          6/2/2022 8:24:12 AM
Event ID:      10016
Task Category: None
Level:         Warning
Keywords:      Classic
User:          LOCAL SERVICE
Computer:      dunx1
Description:
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
    <EventID Qualifiers="0">10016</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2022-06-02T12:24:12.9563534Z" />
    <EventRecordID>93742</EventRecordID>
    <Correlation ActivityID="{c67ab47a-d335-4a13-a6ee-7c564574ae5c}" />
    <Execution ProcessID="1372" ThreadID="19452" />
    <Channel>System</Channel>
    <Computer>dunx1</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
    <Data Name="param1">application-specific</Data>
    <Data Name="param2">Local</Data>
    <Data Name="param3">Activation</Data>
    <Data Name="param4">{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}</Data>
    <Data Name="param5">{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}</Data>
    <Data Name="param6">NT AUTHORITY</Data>
    <Data Name="param7">LOCAL SERVICE</Data>
    <Data Name="param8">S-1-5-19</Data>
    <Data Name="param9">LocalHost (Using LRPC)</Data>
    <Data Name="param10">Unavailable</Data>
    <Data Name="param11">Unavailable</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-DistributedCOM
Date:          6/2/2022 8:24:12 AM
Event ID:      10016
Task Category: None
Level:         Warning
Keywords:      Classic
User:          LOCAL SERVICE
Computer:      dunx1
Description:
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 and APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
    <EventID Qualifiers="0">10016</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2022-06-02T12:24:12.9563534Z" />
    <EventRecordID>93741</EventRecordID>
    <Correlation ActivityID="{b1d9bad4-deb9-49f5-b3ff-63c9d0e6ce0e}" />
    <Execution ProcessID="1372" ThreadID="19452" />
    <Channel>System</Channel>
    <Computer>dunx1</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
    <Data Name="param1">application-specific</Data>
    <Data Name="param2">Local</Data>
    <Data Name="param3">Activation</Data>
    <Data Name="param4">{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}</Data>
    <Data Name="param5">{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}</Data>
    <Data Name="param6">NT AUTHORITY</Data>
    <Data Name="param7">LOCAL SERVICE</Data>
    <Data Name="param8">S-1-5-19</Data>
    <Data Name="param9">LocalHost (Using LRPC)</Data>
    <Data Name="param10">Unavailable</Data>
    <Data Name="param11">Unavailable</Data>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-NDIS
Date:          6/2/2022 8:24:11 AM
Event ID:      10317
Task Category: PnP
Level:         Error
Keywords:      (16384),(16),(4),(2)
User:          N/A
Computer:      dunx1
Description:
Miniport Microsoft Wi-Fi Direct Virtual Adapter #2, {ac07c9db-fcdb-4f46-a516-fb0bdceb1c27}, had event Fatal error: The miniport has failed a power transition to operational power
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-NDIS" Guid="{cdead503-17f5-4a3e-b7ae-df8cc2902eb9}" />
    <EventID>10317</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>2</Task>
    <Opcode>0</Opcode>
    <Keywords>0x2000000000004016</Keywords>
    <TimeCreated SystemTime="2022-06-02T12:24:11.9897499Z" />
    <EventRecordID>93720</EventRecordID>
    <Correlation ActivityID="{ac07c9db-fcdb-4f46-a516-fb0bdceb1c27}" />
    <Execution ProcessID="4" ThreadID="12460" />
    <Channel>System</Channel>
    <Computer>dunx1</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="IfGuid">{ac07c9db-fcdb-4f46-a516-fb0bdceb1c27}</Data>
    <Data Name="IfIndex">12</Data>
    <Data Name="IfLuid">19985273135824896</Data>
    <Data Name="AdapterName">Microsoft Wi-Fi Direct Virtual Adapter #2</Data>
    <Data Name="MiniportEventEnum">74</Data>
  </EventData>
</Event>

Log Name:      Microsoft-Windows-Dhcp-Client/Admin
Source:        Microsoft-Windows-Dhcp-Client
Date:          6/2/2022 8:24:11 AM
Event ID:      1003
Task Category: Address Configuration State Event
Level:         Warning
Keywords:      (1)
User:          LOCAL SERVICE
Computer:      dunx1
Description:
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 0x2C0DA7FFA113.  The following error occurred: 0x79. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Dhcp-Client" Guid="{15a7a4f8-0072-4eab-abad-f98a4d666aed}" />
    <EventID>1003</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>3</Task>
    <Opcode>77</Opcode>
    <Keywords>0x4000000000000001</Keywords>
    <TimeCreated SystemTime="2022-06-02T12:24:11.7070502Z" />
    <EventRecordID>245</EventRecordID>
    <Correlation />
    <Execution ProcessID="2408" ThreadID="8352" />
    <Channel>Microsoft-Windows-Dhcp-Client/Admin</Channel>
    <Computer>dunx1</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
    <Data Name="HWLength">6</Data>
    <Data Name="HWAddress">2C0DA7FFA113</Data>
    <Data Name="StatusCode">121</Data>
  </EventData>
</Event>