zwinuser/zwinpass format

I'm trying to use Egor's WMI datasource zenpack, but it just returns the error

ERROR: Retrieve result data.
NTSTATUS: NT code 0x80041017 - NT code 0x80041017

Which searching around seems to be a syntax error but I don't believe it's my query causing the issue. Any ideas ?

I'm currently using DOMAIN\User as my format of my zWinUser zproperty and that has worked fine for pulling the event logs and anything else coming from WMI

Thanks,
Tom