2025-09-11T11:16:51.273412 AD\adm-jamesp \Update Rubrik true <QueryList><Query Id="0" Path="Microsoft-Windows-FailoverClustering/Operational"><Select Path="Microsoft-Windows-FailoverClustering/Operational">*[System[Provider[@Name='Microsoft-Windows-FailoverClustering'] and EventID=1254]]</Select></Query></QueryList> S-1-5-21-3844332399-1078524487-2751359921-1104 Password LeastPrivilege IgnoreNew true true true false false true false true true false false false PT72H 7 C:\Rubrik\Scripts\failover.cmd