Files are attached. I managed to catch the server early this morning when it wasn't in direct use, so the LogFile.PML file was relatively small. Apparently ProcMon had been run on this server previously, as it had a backing file defined. I reset the ProcMon options to defaults prior to running the commands, but if you feel there are other settings I should check, please let me know.