Windows event logEvent ID 101
4 event logs use this ID, and it means a different thing in each one. Pick the log you have.
Logs with event ID 101
4 channels
- ApplicationSession disconnectedApplication.evtx
- Microsoft-Windows-DeviceSetupManager/AdminMicrosoft-Windows-DeviceSetupManager service shutting downMicrosoft-Windows-DeviceSetupManager%4Admin.evtx
- Microsoft-Windows-Diagnostics-Performance/OperationalBoot Performance Monitoring DegradationMicrosoft-Windows-Diagnostics-Performance%4Operational.evtx
- Symantec Endpoint Protection ClientSymantec Endpoint Protection client is unable to connect to the management serverSymantec Endpoint Protection Client.evtx