2013-02-11T20:43:19.2135714
Kessel\M
true
<QueryList><Query Id="0" Path="Microsoft-Windows-WindowsUpdateClient/Operational"><Select Path="Microsoft-Windows-WindowsUpdateClient/Operational">*[System[Provider[@Name='Microsoft-Windows-WindowsUpdateClient'] and EventID=26]]</Select></Query></QueryList>
true
<QueryList><Query Id="0" Path="Microsoft-Windows-WindowsUpdateClient/Operational"><Select Path="Microsoft-Windows-WindowsUpdateClient/Operational">*[System[Provider[@Name='Microsoft-Windows-WindowsUpdateClient'] and EventID=40]]</Select></Query></QueryList>
S-1-5-18
HighestAvailable
IgnoreNew
true
true
true
false
false
false
false
true
true
false
false
false
PT1H
7
"C:\Program Files\Windows Defender\MpCmdRun.exe"
-SignatureUpdate