Windows event logEvent ID 2
8 event logs use this ID, and it means a different thing in each one. Pick the log you have.
Logs with event ID 2
8 channels
- Microsoft-Windows-Sysmon/OperationalA process changed a file creation timeMicrosoft-Windows-Sysmon%4Operational.evtx
- SystemAn attempt to exploit a known vulnerability detectedSystem.evtx
- ApplicationCylance alertApplication.evtx
- OpenSSH/AdminSSH errorOpenSSH%4Admin.evtx
- Microsoft-Windows-User Profile Service/OperationalAn account was logged onMicrosoft-Windows-User Profile Service%4Operational.evtx
- Microsoft-Windows-VHDMP-OperationalA VHD has been removedMicrosoft-Windows-VHDMP-Operational.evtx
- Microsoft-Windows-VHDMP/OperationalA VHD has been removedMicrosoft-Windows-VHDMP%4Operational.evtx
- Symantec Endpoint Protection ClientScan stoppedSymantec Endpoint Protection Client.evtx