Does anyone know if queries to the users table in windows 10 triggers windows security event 4798, or if it's something else?