SEPM shows log on user as root irrespective of logged in user on the endpoint .