#include <StringConstants.au3> ; to declare the Constants of StringRegExp
#include <Array.au3> ; UDF needed for _ArrayDisplay and _ArrayConcatenate
Local $sRegex = "(?m)<EventID>4702<\/EventID>|<TimeCreated SystemTime='[^']+'\/>|<Computer>[^<]+<\/Computer>|<Data Name='[^']+'>[^<]+<\/Data>:"
Local $sString = "<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4702</EventID><Version>1</Version><Level>0</Level><Task>12804</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2024-12-05T14:59:44.9923272Z'/><EventRecordID>2470365</EventRecordID><Correlation ActivityID='{625186de-46eb-0000-1689-5162eb46db01}'/><Execution ProcessID='1408' ThreadID='1600'/><Channel>Security</Channel><Computer>Host</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>S-1-5-20</Data><Data Name='SubjectUserName'> Host $</Data><Data Name='SubjectDomainName'> Host </Data><Data Name='SubjectLogonId'>0x3e4</Data><Data Name='TaskName'>\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask</Data><Data Name='TaskContentNew'><?xml version="1.0" encoding="UTF-16"?>" & @CRLF & _
"<Task version="1.6" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">" & @CRLF & _
"<RegistrationInfo>" & @CRLF & _
"<Source>$(@%systemroot%\system32\sppc.dll,-200)</Source>" & @CRLF & _
"<Author>$(@%systemroot%\system32\sppc.dll,-200)</Author>" & @CRLF & _
"<Version>1.0</Version>" & @CRLF & _
"<Description>$(@%systemroot%\system32\sppc.dll,-201)</Description>" & @CRLF & _
"<URI>\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask</URI>" & @CRLF & _
"<SecurityDescriptor>D:P(A;;FA;;;SY)(A;;FA;;;BA)(A;;FA;;;S-1-5-80-123231216-2592883651-3715271367-3753151631-4175906628)(A;;FR;;;S-1-5-87-2912274048-3994893941-1669128114-1310430903-1263774323)</SecurityDescriptor>" & @CRLF & _
"</RegistrationInfo>" & @CRLF & _
"<Triggers>" & @CRLF & _
"<CalendarTrigger>" & @CRLF & _
"<StartBoundary>2024-12-10T07:54:44Z</StartBoundary>" & @CRLF & _
"<Enabled>true</Enabled>" & @CRLF & _
"<ScheduleByDay>" & @CRLF & _
"<DaysInterval>1</DaysInterval>" & @CRLF & _
"</ScheduleByDay>" & @CRLF & _
"</CalendarTrigger>" & @CRLF & _
"</Triggers>" & @CRLF & _
"<Principals>" & @CRLF & _
"<Principal id="NetworkService">" & @CRLF & _
"<UserId>S-1-5-20</UserId>" & @CRLF & _
"<RunLevel>LeastPrivilege</RunLevel>" & @CRLF & _
"</Principal>" & @CRLF & _
"</Principals>" & @CRLF & _
"<Settings>" & @CRLF & _
"<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>" & @CRLF & _
"<DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>" & @CRLF & _
"<StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>" & @CRLF & _
"<AllowHardTerminate>false</AllowHardTerminate>" & @CRLF & _
"<StartWhenAvailable>true</StartWhenAvailable>" & @CRLF & _
"<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>" & @CRLF & _
"<IdleSettings>" & @CRLF & _
"<StopOnIdleEnd>true</StopOnIdleEnd>" & @CRLF & _
"<RestartOnIdle>false</RestartOnIdle>" & @CRLF & _
"</IdleSettings>" & @CRLF & _
"<AllowStartOnDemand>true</AllowStartOnDemand>" & @CRLF & _
"<Enabled>true</Enabled>" & @CRLF & _
"<Hidden>true</Hidden>" & @CRLF & _
"<RunOnlyIfIdle>false</RunOnlyIfIdle>" & @CRLF & _
"<DisallowStartOnRemoteAppSession>false</DisallowStartOnRemoteAppSession>" & @CRLF & _
"<UseUnifiedSchedulingEngine>true</UseUnifiedSchedulingEngine>" & @CRLF & _
"<WakeToRun>false</WakeToRun>" & @CRLF & _
"<ExecutionTimeLimit>PT0S</ExecutionTimeLimit>" & @CRLF & _
"<Priority>7</Priority>" & @CRLF & _
"<RestartOnFailure>" & @CRLF & _
"<Interval>PT1M</Interval>" & @CRLF & _
"<Count>3</Count>" & @CRLF & _
"</RestartOnFailure>" & @CRLF & _
"</Settings>" & @CRLF & _
"<Actions Context="NetworkService">" & @CRLF & _
"<ComHandler>" & @CRLF & _
"<ClassId>{B1AEBB5D-EAD9-4476-B375-9C3ED9F32AFC}</ClassId>" & @CRLF & _
"<Data><![CDATA[timer]]></Data>" & @CRLF & _
"</ComHandler>" & @CRLF & _
"</Actions>" & @CRLF & _
"</Task></Data><Data Name='ClientProcessStartKey'>26177172834095606</Data><Data Name='ClientProcessId'>2408</Data><Data Name='ParentProcessId'>1368</Data><Data Name='RpcCallClientLocality'>0</Data><Data Name='FQDN'>Host</Data></EventData></Event>"
Local $aArray = StringRegExp($sString, $sRegex, $STR_REGEXPARRAYGLOBALFULLMATCH)
Local $aFullArray[0]
For $i = 0 To UBound($aArray) -1
_ArrayConcatenate($aFullArray, $aArray[$i])
Next
$aArray = $aFullArray
; Present the entire match result
_ArrayDisplay($aArray, "Result")
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for AutoIt, please visit: https://www.autoitscript.com/autoit3/docs/functions/StringRegExp.htm