Windows event logEvent ID 200
4 event logs use this ID, and it means a different thing in each one. Pick the log you have.
Logs with event ID 200
4 channels
- Microsoft-Windows-TerminalServices-Gateway/OperationalRemote Desktop Services: User meets resource authorization policy requirements needed to connect to TS Gateway serverMicrosoft-Windows-TerminalServices-Gateway%4Operational.evtx
- Microsoft-Windows-Diagnostics-Performance/OperationalWindows System was shutdownMicrosoft-Windows-Diagnostics-Performance%4Operational.evtx
- Microsoft-Windows-TaskScheduler/OperationalScheduled Task executedMicrosoft-Windows-TaskScheduler%4Operational.evtx
- Symantec Endpoint Protection ClientContent downloaded successfully to the clientSymantec Endpoint Protection Client.evtx