Fixing this now. The two events should really happen the same way. To answer your second question: EventJobUnscheduled has a value that should match the local machine ID, while EventJobDeleted refers to a directory.