Perfect Information. Thank you very much for making this content available.
I am doing an analysis in my environment and I receive several connections and disconnections with the sequences of reasons 0 and 5 in eventvwr (Microsoft-Windows-TerminalServices-LocalSessionManager) EventID 40.