When do you get the RestartDetected alarm with the ntservices probe?