Windows event logEvent ID 24
3 event logs use this ID, and it means a different thing in each one. Pick the log you have.
Logs with event ID 24
3 channels
- Microsoft-Windows-Sysmon/OperationalClipboardChange (New content in the clipboard)Microsoft-Windows-Sysmon%4Operational.evtx
- Microsoft-Windows-TerminalServices-LocalSessionManager/OperationalRemote Desktop Services: Session has been disconnectedMicrosoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx
- Symantec Endpoint Protection ClientSymantec Endpoint Protection Auto-Protect DisabledSymantec Endpoint Protection Client.evtx