Windows event logEvent ID 21
3 event logs use this ID, and it means a different thing in each one. Pick the log you have.
Logs with event ID 21
3 channels
- Microsoft-Windows-Sysmon/OperationalWmiEvent (WmiEventConsumerToFilter activity detected)Microsoft-Windows-Sysmon%4Operational.evtx
- Microsoft-Windows-TerminalServices-LocalSessionManager/OperationalRemote Desktop Services: Session logon succeededMicrosoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx
- Symantec Endpoint Protection ClientScan canceledSymantec Endpoint Protection Client.evtx