<ViewerConfig>
  <QueryConfig>
    <QueryParams>
      <UserQuery />
    </QueryParams>
    <QueryNode>
      <Name>Remote Access</Name>
      <Description>System events for Remote Access role</Description>
      <SuppressQueryExecutionErrors>1</SuppressQueryExecutionErrors>
      <QueryList>
        <Query>
          <Select Path="System">*[System[Provider[@Name='RemoteAccess']]]</Select>
          <Select Path="System">*[System[Provider[@Name='Microsoft-Windows-RasSstp']]]</Select>
          <Select Path="AD FS/Admin">*[System[Provider[@Name='AD FS']]]</Select>
          <Select Path="Microsoft-Windows-WebApplicationProxy/Admin">*[System[Provider[@Name='Microsoft-Windows-WebApplicationProxy']]]</Select>
          <Select Path="Microsoft-Windows-RemoteAccess-MgmtClient/Admin">*[System[Provider[@Name='Microsoft-Windows-RemoteAccess-MgmtClient']]]</Select>
          <Select Path="Microsoft-Windows-RemoteAccess-RemoteAccessServer/Admin">*[System[Provider[@Name='Microsoft-Windows-RemoteAccess-RemoteAccessServer']]]</Select>
        </Query>
      </QueryList>
    </QueryNode>
  </QueryConfig>
</ViewerConfig>