Event Details
Operating System->InTrust Superior logon/logoff events->EventID 121 - User session monitoring service was stopped.
EventID 121 - User session monitoring service was stopped.
The user session monitoring service was stopped on computer %Where% at %when%.

Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: InTrust User Session Tracking
Filtering Field Equals to Value
EventId 121
Field Matching
FieldDescriptionStored inSample Value
DateTime Date/Time of event origination in GMT format. -
Source Name of an Application or System Service originating the event. -
Type Warning, Information, Error, Success, Failure, etc. -
User Domain\Account name of user/service/computer initiating event. -
Computer Name of server workstation where event was logged. -
EventID Numerical ID of event. Unique within one Event Source. -
Description The entire unparsed event message. -
Log Name The name of the event log (e.g. Application, Security, System, etc.) -
User Name User name. -
Domain Name Domain name. -
DNS Domain Name DNS domain name. InsertionString7
User's SID User's SID. InsertionString8
Terminal Services Session ID Terminal Services session ID. InsertionString13
You must be logged in to comment