writingauditrecordstowindowseventl