@nnipsx I'd recommend https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/default.aspx as a reference point. That's pretty much the Bible for Windows event logging