The email is sent as soon as the event is generated on the host. If when you connect by RDP, the situation in that Endpoint has already changed, you will find everything correct. By default all these events are disabled in Cloud and should only be activated, in order to perform specific follow-ups.
>> the question is: when this message is be created ? Also if the services are not running on Windows startup ? So, each day these messages will appear... I´ll take a look where I can disable those alerts.