$aevents = $Wmi->ExecQuery("SELECT * FROM $Win32_Class  WHERE LogFile='Security' AND Eventcode=560")