Windows event logEvent ID 23
3 event logs use this ID, and it means a different thing in each one. Pick the log you have.
Logs with event ID 23
3 channels
- Microsoft-Windows-Sysmon/OperationalFileDelete (A file delete was detected)Microsoft-Windows-Sysmon%4Operational.evtx
- Microsoft-Windows-TerminalServices-LocalSessionManager/OperationalRemote Desktop Services: Session logoff succeededMicrosoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx
- Symantec Endpoint Protection ClientSymantec Endpoint Protection Auto-Protect EnabledSymantec Endpoint Protection Client.evtx