Security log shows connected administrator account when it is not

No idea why the administrator account should connect with a logon (local) of type 2 when it is not currently connected to the console?

For some time, security watch logs, immediately, logs user account in my Windows 7 SP1 machine, there are two consecutive event ID 4624, connection type 2, for the successful administrator account by connecting you with identification information explicit.  It is an event ID 4672 setting privileges for this admin account and then a 3634 event, the session is disconnected.   All this is happening less than a second of logon user account, often in the same second.

This caught my eye today when I was connected but disks have been slowed and then spun wait a few minutes.  Checking the logs showed the same logon activity at the time the boot disks.  System, the installation program, application logs did not show any unusual entries.

Verified services and scheduled tasks, and none of them run under the administrator credentials.  Ran detectors AV and malware - nothing wrong.  Contacted support the AV vendor - they don't detect any problem.  Use of the network of the machine within the normal parameters.  Firewall logs does not show a successful intrusion.

Tried to create a new administrator account and disable the old one.  This stopped the behavior temporarily without seeming to affect my machine, but he did it again today.

Where else I could check or what else could be the cause?

Hello

Thanks for posting your query in Microsoft Community.

I understand your concern regarding the issue that you are facing.

You are connected to the field?

I suggest you check the event viewer for error logs. See the following steps:

(a) press the Windows key + X, select event viewer.
(b) click Windows logs and application logs.
(c) check the logs of related error.
(d) paste the contents of the newspapers in your response.

I hope this helps to solve the issue. If the problem persists, get back to us. We will be happy to help you

Tags: Windows

Similar Questions

  • Why my macbook air back show my Facebook messages when I am not connected? What can I do to stop?

    Why my macbook air back show my Facebook messages when I am not connected? What can I do to stop?

    Hello, welcome to the discussion!

    If you are referring to push notifications on your desktop, you most likely have Facebook as an internet account on your MacBook. You can withdraw from your account, or disable notifications for it.

    Open system preferences > Internet accounts

    Select Facebook

    Uncheck the Notifications tab to disable the notifications or click on the "-" button to remove the account

  • I am logged in as administrator. When I try to move the files from drive c to e drive, I get the message that I have currently not authorized to access this file.

    Administrator permissions

    I am logged in as administrator.  When I try to move the files from drive c to e drive, I get the message that I currently don't have permission
    to access this file.

    As an administrator, I though I had permission.  How can I fix it?

    I've only logged on as administrator.

    Even logged on as administrator, you have not all privileges unless you raise them. This is done to prevent malware to take control of your computer when logged in as an administrator.

    What files you try to move?

  • My lg800g phone shows connected to the computer but is not assigned a drive letter

    My lg800g phone shows connected to the computer but is not assigned a drive letter

    Hello

    You can manually assign the letter.

    Check out the link and check if that helps.

    Change, add, or remove a drive letter

    If you have any questions on Windows, feel free to let us know. We are happy to be of assistance.

  • My computer will not connect administrator account

    When I get to the home screen, and I try to put my password to open a session in my account (which is also my administrator account) .He told me that user logon Service failed to connect.

    I can connect in all other standard users without problem, but when I try to use the administrator command prompt, I get a message requesting my password--and it does not use the command prompt.

    I also tried to do this in safe mode, but it simply doesn't. What should I do?

    You can try in 2 ways. .....
    Assuming that your full is the error message:
    The user profile service has not logon. User profile cannot be loaded

    1 use this tutorial:
    http://www.Vistax64.com/tutorials/130095-user-profile-service-failed-logon-user-profile-cannot-loaded.html

    2. do a system restore. Choose a date where you did NOT have this problem as your restore point:
    Start button > Search box, type system restore > press the Enter key > uac prompt > click on choose a different restore point > next > select dates as your restore point, until the click > next > finish
    To sit and wait. The machine restarts when it's done.

    t-4-2
  • How do I change user to the administrator account when it all together to standard users.

    Hi I set up my computer girl with their username first and then when I put mine up to put parental controls on it mine was the standard user. I changed mine to the administrator and his standard, but how some were now two standard users. I can't enter in allocate framework and programs now, he asks me the administrator password, but me don't give no option to enter one. I was about to reinstall windows, but there is no disk with him. All the world and ideas how to fix it.

    Thank you

    Ryan

    You can use system restore to set up Windows to a point until you have changed the password now:
    1. put your BIOS so that it uses the DVD drive as its primary boot device.
    2 start the computer with your Windows 7 repair CD.
    3. press a button if you are prompted to start from the DVD.
    4. When prompted, select "Safe Mode Command Prompt".
    5 log in as administrator if you are prompted.
    6. Select repair when prompted.
    7. When you are prompted, select System Restore.
    8. set Windows to a point before this problem occurred.
    9. When finished, remove the CD before restarting the system.
    In step 2, you can also use the Windows 7 installation DVD. The subsequent steps are similar to those above.

    When you're done, plan and create a second account. admin record its details on paper so that it will never happen.

  • Logged on as administrator, but when trying to turn on automatically the incident reports, the option is grayed out

    Even though I am the administrator, when I try to turn on automatically incident reports and solutions is dimmed and the help prompt indicates it needs to be done by the system administrator... but it's me!   Click Advanced settings, but which is all gray too.  Having checked that I am the only admin on the computer (users are only me and Mrs. L and daughter).  Can someone tell me how to sort.

    Thank you

    Hi Lupty,

    Let me know your OS. Because the administrator account is disabled by default in Vista & Win7.Run the command to activate the account below:

    NET user administrator / Active: Yes

    Now to reconnect with administrator account and try to use the feature.
    _________________________________________________________________________
    AmS8_7 (MCSE, MCSA, CCNA, network + / has +):-If this post can help solve your problem, please click the 'Mark as answer' or 'useful '. By marking a post as answer, or relatively useful you help others find the answer more quickly.

  • try to change the mode of feeding for a user account, the instructions worked to change the administrator account, but changes do not appear on user accounts.

    On my HP 510 laptop, I want to change the power mode to one of the user accounts.  It cannot be changed of in the user account, so I followed these instructions: log in as administrator, do the selection desired in the list of available eating patterns (Control Panel, Power Options, eating patterns), click on apply, then log in as administrator.  I find that the selected power mode has been applied to the administrator account, but not to one of the user accounts. I tried to change in the user account, but still receive the "access denied" response

    I recently installed Microsoft Security Essentials. My reading of various internet stations indicate that some older antivirus programs may have hindered this process of power management. I was not able to discover how to inactivate Security Essentials, so did not try to change the mode of power without interference from her.

    Another indicated position of the potential interference of the BIOS settings. I don't know how to check if this may be the case. I have MS Windows XP Pro SP3 installed. I have automatic and current updates.

    Thanks for any help, you can suggest.

    Hello

    You can change the setting in see Group Policy for this document:

    http://TechNet.Microsoft.com/en-us/library/cc730920.aspx

    Or change temporarily the user to an admin account, make the changes and then return as a standard user.

    Thanks and regards.

    Thahaseena M
    Microsoft Answers Support Engineer.
    Visit our Microsoft answers feedback Forum and let us know what you think.

  • VISTA administrator accounts disabled. Could not activate the hidden admin

    HI - all my VISTA administrator accounts are disabled. I could not allow the hidden administrator because it requires an active administrator. Can you help me create an admin user?

    Thank you
    Ganesh

    HI - all my VISTA administrator accounts are disabled. I could not allow the hidden administrator because it requires an active administrator. Can you help me create an admin user?

    Thank you
    Ganesh

    Sorry, if you are not set up as an administrator user account, you cannot enable the built-in administrator.

    This forum prohitbits someone help users to bypass the password protection, regardless of the reasons.

    This is the policy of the forum:

    http://answers.Microsoft.com/en-us/Windows/Forum/Windows_7-security/keeping-passwords-secure-Microsoft-policy-on/39f56ef0-5d68-41AD-9daa-6e6019c25d37

  • ReadyCloud shows NAS as offline when it's not (SOLVED)

    (Mods if this topic is in the wrong place please remove because I also responded to http://www.readynas.com/forum/viewtopic.php?f=7&t=81208 , in the hope of an answer)

    I have a RN102 with firmware v6.2.4.

    To attempt to connect to ReadyCloud, I get the error "" * white * NAS is offline, check internet connectivity and power ""

    I can ping my NAS successfully, it can look by using File Explorer, can access the admin page by typing the IP address and access all of my files in the admin console but ReadyCloud shows my NAS as offline and does not display any of my data, also tried the button "backup" on the device for 5 seconds and looking for serial number on the tab 'Discover' in a couple of the last desperate attempts... really confused , but I would not be surprised if it was a self-inflicted question:? ops :

    I am currently turn off ReadyCloud and waiting for my reboot to re - activate ReadyCloud to see if it solves my problem.

    I'll edit the post or add another answer to follow once I did.

    EDIT *.

    So I tried the reactivation of ReadyCloud after the restart of the SIN and this is what displayed... any ideas to resolve this would be greatly appreciated

    Hello

    In case you used a static IP address, please make sure that the DNS settings are configured correctly.

    Bye,.
    Martial

  • Cannot connect administrator account. Error - the Group Policy Client service has no logon. Access is denied

    Original title - MESSAGE of ERROR

    Hello

    I am runnung Windows Vista on my laptop Toshiba A200. As of a few days ago, asking that I try to open a session (I'm the admin), I get an error message saying "the Group Policy Client service does not log. Access is denied. »

    I managed to get in the "back door" through my wife and did a system full scan with Norton and Spybot and neither found anything unusual. He asked me to change my user account settings, but of course, because my wife is not the admin, he won't let my do changes.

    In addition, some of my software, such as Final draft, also seem to have vaporized.

    Help!

    Thanks in advance,

    Steve Hayward

    Hi stevehayward

     

    1. is the computer on a domain?
    2. during how long have you had this problem?

     

    If the computer is not connected to the domain, you can start in safe mode, and then try to perform a system restore.
    Step 1
    :
    In safe mode; you have access to only the drivers and base files. Check out the link to start the computer in safe mode and then check-
    http://Windows.Microsoft.com/en-us/Windows7/start-your-computer-in-safe-mode

     

    Step 2:
    You can perform a restore of the system to a previous point, when the issue was not present. The System Restore tool uses points of restore to return the system files and settings to an earlier point in time. You can use it to restore the operating system to a point in time where you have not experienced the problem.

    Note: When you use System restore to restore the computer to a previous state, programs and updates that you have installed are removed.

    To do this, there must be a restore point from the system in which the connection was successful.

    Please refer to the below of the help links on performing a system restore.
    http://Windows.Microsoft.com/en-us/Windows-Vista/what-is-system-restore
    http://Windows.Microsoft.com/en-us/Windows-Vista/system-restore-frequently-asked-questions

    I hope this helps.

  • Why my log shows an error MSPublisher when I have zero installed software MS

    In general, I only put my iMac to sleep then when I had to start rather than wake up it I checked the log. I have not found no answer to my question about why he had to be restarted, but all looking at, I discovered this message:

    "

    July 24, 2016, 13:56:26 cloudphotosd [443]: error: error Domain = MSPublisherErrorDomain Code = 1 "the picture was rejected for download." UserInfo = {NSLocalizedDescription = photo was rejected for download.}

    July 24, 2016, 13:56:26 cloudphotosd [443]: MSPublisher - 278833312 derivatives of the applicant for files 1.

    July 24, 2016, 13:56:27 cloudphotosd [443]: MSPublisher - 278833312 1 asset collections submitted for publication.

    July 24, 2016, 13:56:27 cloudphotosd [443]: MSPublisher - 278833312 sending metadata... »

    Why my Mac tries to submit a photo to MSPublisher? I use MS No. software absolutely on the Mac and have never

    Just curious... thanks to anyone with an answer...

    There were some users with more than a year there are questions, a similar topic;

    that they did not use a version update of Mac OS X, if the error can

    have been fixed (at the time, because of the most recent update of their/then OS X.)

    What OS X using your Mac? And this version of build, is up-to-date?

    The error reflects the icloud and not necessary that OS X is

    with the files; the line MSPublisher is not indicative of Mac OS X, trying to

    address certain Microsoft software directly; but in the older version of OS X

    10.10.3 an update had problems, one of the symptoms was this error.

    Last year in another discussion of ASC, contributor Linc Davis helped

    to try a diagnostic test and troubleshooting a similar issue. Perhaps it will be

    See your question and propose means for redress...

    10.10.3 slow and horrible - where similar problem was addressed in CSA.

    If your computer is to say running Yosemite 10.10.3, it should be updated

    in the final stage of the system it contains. Some users to keep an older OS X if

    they do not have an iDevice to manufacturing later, with new requirements of iOS.

    Have you tried to secure boot, then use disk utility to repair permissions. Restart

    normal? Or utility disk in OS X Recovery, to repair the disk and also permissions.

    Then the output D.U. and recovery and boot into Mac OS x.

    Don't see no response, after some research, I thought to give a response;

    & do not mean the steps detailed here can be a cure for a symptom.

    Good luck!

  • Can connect to internet when wired, but not wireless

    Just restarted my computer laptop and now unable to connect to the internet.via my wireless router. Am connected to the router, but not the router to the internet. Can connect to the internet by a cable in the router to my laptop. The computer identifies the network correctly when it is wired, but shows as not identified during the use of the wireless router. Already fed the moden and router down twice, without change. other phones that I use are able to access the intwrnet via the wireless router, so I think it has to do with the system restart I just did on this laptop. Any ideas would be helpful

    Hello

    You did it all changes on the computer (which is originally this issue) before this problem?

    Read the following article that may help you.
    Windows wireless and wired network connection problems
    http://Windows.Microsoft.com/en-us/Windows/help/wired-and-wireless-network-connection-problems-in-Windows

  • What would cause a Subvi show its FP even when it is not defined to show (by default)?

    I have a Subvi suddenly decided to show even when it should.  What kinds of things would cause this?

    Thank you!


  • I have Windows XP and configure a separate password administration account. (I have not configured a hint.) Now I forgot the password. Do I have any options other than re - install Windows?

    Cannot load or remove programs without administrative rights. Help!

    A Microsoft Supported forum, the best advice that you can get here are covered in the following article:

    "Microsoft's strategy concerning lost or forgotten passwords"
    <>http://support.Microsoft.com/kb/189126 >

    Despite its title, it contains pointers to useful techniques to treat your password.
    In the end, however, the answer to your question is likely: Yes, you have options, but no, you won't find them here.
    (Security by obscurity)

    HTH,
    JW

Maybe you are looking for