writingauditrecordstowindowsevent