<QueryList xmlns="http://schemas.microsoft.com/win/2004/08/events/eventquery">
  <Query Id="0" Path="Application">
    <Select Path="Application">*</Select>

    <!--
      Sources with high volume informational events rarely of interest

      PROVIDER                    DESCRIPTION
      ADSync                      Azure AD Sync
      Directory Synchronization   Azure AD Directory Synchronization
      edgeupdate                  Edge Update
      gupdate                     Google Update
      MSSQLSERVER                 Microsoft SQL Server
      Outlook                     Microsoft Outlook
      RestartManager              Windows Restart Manager
      Security-SPP                Windows Software Protection Platform
      vmauthd                     VMware Authorization Service
    -->
    <Suppress Path="Application">
      *[System[
        (
          Provider[@Name='ADSync']
          or
          Provider[@Name='Directory Synchronization']
          or
          Provider[@Name='edgeupdate']
          or
          Provider[@Name='gupdate']
          or
          Provider[@Name='Microsoft-Windows-RestartManager']
          or
          Provider[@Name='Microsoft-Windows-Security-SPP']
          or
          Provider[@Name='MSSQLSERVER']
          or
          Provider[@Name='Outlook']
          or
          Provider[@Name='vmauthd']
        )
        and
        Level=4
      ]]
    </Suppress>

    <!--
      Source:     Application Error
      Level:      Error
      Message:    <ERROR_DETAILS>

      The Group Policy Management Console often crashes on exit with no notification or functional impact.

      See also the suppression for the associated Windows Error Reporting events.
    -->
    <Suppress Path="Application">
      *[System[Provider[@Name='Application Error'] and EventID=1000]]
      and
      *[EventData[Data='mmc.exe' and Data='GPOAdmin.dll' and Data='c0000005']]
    </Suppress>

    <!--
      Source:     CertificateServicesClient-AutoEnrollment
      Level:      Warning
      Message:    Certificate for %1 with Thumbprint %2 is about to expire or already expired.

      Expiring or expired certificates aren't necessarily a problem and other events are logged on enrollment failures.
    -->
    <Suppress Path="Application">
      *[System[Provider[@Name='Microsoft-Windows-CertificateServicesClient-AutoEnrollment'] and EventID=64]]
    </Suppress>

    <!--
      Source:     COMRuntime
      Level:      Error
      Message:    An unmarshaling policy check was performed when unmarshaling a custom marshaled object and the class {45FB4600-E6E8-4928-B25E-50476FF79425} was rejected
      Data:       Com Call Wrapper Unmarshal Class 4.0

      Microsoft-Windows-COMRuntime error on your OMS agents
      https://docs.microsoft.com/en-us/archive/blogs/msoms/microsoft-windows-comruntime-error-on-your-oms-agents
    -->
    <Suppress Path="Application">
      *[System[Provider[@Name='Microsoft-Windows-COMRuntime'] and EventID=10031]]
      and
      *[EventData[Data='{45FB4600-E6E8-4928-B25E-50476FF79425}']]
    </Suppress>

    <!--
      Source:     Defrag
      Level:      Error
      Message:    The volume %1 was not optimized because an error was encountered:
                  Neither Slab Consolidation nor Slab Analysis will run if slabs are less than 8 MB. (0x8900002D)

      Effectively harmless and often the case on VMs with thin-provisioned storage.
    -->
    <Suppress Path="Application">
      *[System[Provider[@Name='Microsoft-Windows-Defrag'] and EventID=257]]
      and
      *[EventData[Data='Neither Slab Consolidation nor Slab Analysis will run if slabs are less than 8 MB. (0x8900002D)']]
    </Suppress>

    <!--
      Source:     Defrag
      Level:      Error
      Message:    The storage optimiser couldn't complete slab consolidation on %2 because:
                  The slab consolidation operation was aborted because a sufficient number of slabs could not be reclaimed (based on the limits specified in the registry). (0x89000028)

      Merely indicates defragmentation is not necessary on the given volume.
    -->
    <Suppress Path="Application">
      *[System[Provider[@Name='Microsoft-Windows-Defrag'] and EventID=264]]
      and
      *[EventData[Data='The slab consolidation operation was aborted because a sufficient number of slabs could not be reclaimed (based on the limits specified in the registry). (0x89000028)']]
    </Suppress>

    <!--
      Source:     RestartManager
      Level:      Warning
      Message:    Application '%3' (pid %2) cannot be restarted - Application SID does not match Conductor SID.

      Rarely of interest and often high volume.
    -->
    <Suppress Path="Application">
      *[System[Provider[@Name='Microsoft-Windows-RestartManager'] and EventID=10010]]
      and
      *[UserData[RmUnsupportedRestartEvent[Reason=1]]]
    </Suppress>

    <!--
      Source:     SceCli
      Level:      Information
      Message:    Security policy in the Group policy objects has been applied successfully.

      Rarely of interest and high volume on domain controllers.
    -->
    <Suppress Path="Application">
      *[System[Provider[@Name='SceCli'] and EventID=1704]]
    </Suppress>

    <!--
      Source:     Windows Error Reporting
      Level:      Information
      Message:    <ERROR_DETAILS>

      The Group Policy Management Console often crashes on exit with no notification or functional impact.

      See also the suppression for the associated Application Error events.
    -->
    <Suppress Path="Application">
      *[System[Provider[@Name='Windows Error Reporting'] and EventID=1001]]
      and
      *[EventData[Data='APPCRASH' and Data='mmc.exe' and Data='GPOAdmin.dll' and Data='c0000005']]
    </Suppress>
  </Query>
</QueryList>