SEP ADC does NOT detect a process termination if the process terminates as part of a service stop (Example: NET STOP <SVC_NAME>). Therefore, ADC does not fully support detection of process terminations. This should be updated to optionally include graceful shutdowns. Additionally, it would be an added benefit if there was an option to exclude the termination only in the event of a locally requested console shutdown\logoff.
An attacker can easily use this SEP loophole against SEP customers.