Elastic Windows Event Explorer


Publisher - Microsoft-Windows-RestartManager

Event ID 10001

Message:

Ending session %{RmSessionId} started %{UTCStartTime}.

Event Data:

# Name In Type
Out Type
1 RmSessionId win:UInt32 xs:unsignedInt
2 UTCStartTime win:FILETIME xs:dateTime

Observed Windows Versions:

Version: 0

Fingerprint: ZXXAEARR4X4I6