drop microsoft-windows-taskscheduler operational evtx csv · detect gaps in task scheduler event records · identify task history clearing and channel disablement · surface scheduled task execution windows that were erased · runs locally
RecordID gaps · 200/201 pairing · 106/141 lifecycle · history clearing · channel disable density · 100+ bulk · 1000+ aggressive
drop Microsoft-Windows-TaskScheduler/Operational evtx csv export