Logon events when you’re not present usually have some windows process as the Security ID and Account Name. Yet I saw logons when not using my laptop with the same data as when I actually logon myself. Some of the data is included below, and it is the same information I see from my actual logons.
An account was successfully logged on.
Subject:
Security ID: SYSTEM
Account Name: NAME$
Account Domain: WORKGROUP
Logon ID: 0x3E7
Logon Information:
Logon Type: 11
Restricted Admin Mode: -
Remote Credential Guard: -
Virtual Account: No
Elevated Token: Yes
Impersonation Level: Impersonation
New Logon:
Security ID: my usual name
Account Name: my email address
Account Domain: MicrosoftAccount
Process Information:
Process ID: 0xa20
Process Name: C:WindowsSystem32svchost.exe
However in the same time stamp there were also logons from
Security ID: Window ManagerDWM-1
Account Name: DWM-1
Account Domain: Window Manager
and
Security ID: Font Driver HostUMFD-1
Account Name: UMFD-1
Account Domain: Font Driver Host
So is it normal to see logons from your own security id and account name after those Microsoft processes logon? Or is it possible someone else accessed my computer? Thanks for the help.
