Add events for copying and deleting certs #3826

Log Name:      Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational
Source:        Microsoft-Windows-CertificateServicesClient-Lifecycle-System
Date:          5/19/2017 12:18:37 PM
Event ID:      1004
Task Category: None
Level:         Information
Keywords:      
User:          domain\user
Computer:      computer.domaindns
Description:
A certificate has been deleted. Please refer to the "Details" section for more information.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-CertificateServicesClient-Lifecycle-System" Guid="{bc0669e1-a10d-4a78-834e-1ca3c806c93b}" />
    <EventID>1004</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2017-05-19T19:18:37.361076000Z" />
    <EventRecordID>4</EventRecordID>
    <Correlation ActivityID="{74818F5C-C9C7-0003-8CA9-A574C7C9D201}" />
    <Execution ProcessID="1599740" ThreadID="1599948" />
    <Channel>Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational</Channel>
    <Computer>computer.domandns</Computer>
    <Security UserID="S-1-5-21-397955417-626881126-188441444-3490812" />
  </System>
  <UserData>
    <CertNotificationData ProcessName="powershell.exe" AccountName="domain\user" Context="Machine">
      <CertificateDetails Thumbprint="cba32b4b7a80792dcce4f80ac2434e1cfaa3b1b1">
        <SubjectNames>
          <SubjectName>CN=Https://xunit.test/fake.svc</SubjectName>
        </SubjectNames>
        <EKUs>
          <EKU Name="Client Authentication" OID="1.3.6.1.5.5.7.3.2" />
        </EKUs>
        <NotValidAfter>2017-11-04T08:27:49Z</NotValidAfter>
      </CertificateDetails>
    </CertNotificationData>
  </UserData>
</Event>