Windows Event Log - Event-ID 5136, Event 4662 filtern und benachrichtigen

<?xml version="1.0" encoding="UTF-16"?>  
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">  
	<RegistrationInfo />
	<Triggers>
		<EventTrigger>
			<Enabled>true</Enabled>
			<Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="Security"&gt;&lt;Select  
				Path="Security"&gt;*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (EventID=5136 or  
			EventID=4662)]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
		</EventTrigger>
	</Triggers>
	<Principals>
		<Principal id="Author">  
			<UserId>S-1-5-18</UserId>
			<RunLevel>LeastPrivilege</RunLevel>
		</Principal>
	</Principals>
	<Settings>
		<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
		<DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
		<StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
		<AllowHardTerminate>true</AllowHardTerminate>
		<StartWhenAvailable>false</StartWhenAvailable>
		<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
		<IdleSettings>
			<Duration>PT10M</Duration>
			<WaitTimeout>PT1H</WaitTimeout>
			<StopOnIdleEnd>true</StopOnIdleEnd>
			<RestartOnIdle>false</RestartOnIdle>
		</IdleSettings>
		<AllowStartOnDemand>true</AllowStartOnDemand>
		<Enabled>true</Enabled>
		<Hidden>false</Hidden>
		<RunOnlyIfIdle>false</RunOnlyIfIdle>
		<WakeToRun>false</WakeToRun>
		<ExecutionTimeLimit>PT72H</ExecutionTimeLimit>
		<Priority>7</Priority>
	</Settings>
	<Actions Context="Author">  
		<Exec>
			<Command>powershell.exe</Command>
			<Arguments>-EP ByPass -C "Send-MailMessage -From 'user@domain.de' -to 'empfaenger@domain.de' -Subject 'Notification' -SmtpServer  
				smtp.domain.de -Credential (New-Object PSCredential('USERNAME',(ConvertTo-SecureString 'PASSWORD' -AsPlainText -Force)))  
			-UseSSL"</Arguments>  
		</Exec>
	</Actions>
</Task>