Windows event logEvent ID 1001
4 event logs use this ID, and it means a different thing in each one. Pick the log you have.
Logs with event ID 1001
4 channels
- ApplicationApplication CrashApplication.evtx
- Splashtop-Splashtop Streamer-Remote Session/OperationalSplashtop session disconnectedSplashtop-Splashtop Streamer-Remote Session%4Operational.evtx
- Microsoft-Windows-Windows Defender/OperationalAn antimalware scan finishedMicrosoft-Windows-Windows Defender%4Operational.evtx
- Microsoft-Windows-Storsvc/DiagnosticUSB ConnectionMicrosoft-Windows-Storsvc%4Diagnostic.evtx