2024-01-01T00:00:00 System Administrator Monitor system shutdown and send Discord notification true SessionLock true <QueryList><Query Id="0" Path="System"><Select Path="System">*[System[Provider[@Name='User32'] and EventID=1074]]</Select></Query></QueryList> S-1-5-18 HighestAvailable IgnoreNew false false true true true false false true true false false false true false PT2M 7 powershell.exe -ExecutionPolicy Bypass -File "C:\Scripts\windows-reboot-monitor.ps1" -EventType "shutdown"