Windows 10: 1 user only yet have multiple Account Names and Logon IDs in Event Log

Hello everyone. I look forward to learning more about Windows 10 and my computer. I was looking at the event log under security and I noticed I have multiple Account Names and Logon Id - see below

Security ID: SYSTEM
Account Name: HENDERSON$
Account Domain: WORKGROUP
Logon ID: 0x3E7

AND

Subject:
Security ID: HENDERSON\Rob
Account Name: Rob
Account Domain: HENDERSON
Logon ID: 0x66EA9E



Does this mean someone else is also logged onto my computer somehow?

:)

 

Events duplication (in event viewer) after successful logon (in event viewer).

Can you please explain me why I see several (looks like duplicated) event in Event Viewer after successful logon.

For example after reboot (Win 10 workstation, no domain, no any specific configuration) I see in security log 2 totally identical logs for event 4624, type 2

The same situation for "Unlock"

I want to show you these events in logs:

In this example PC in domain, and I am reproducing windows UNLOCK (logoff - logon):

FIRST EVENT

Log Name: Security

Source: Microsoft-Windows-Security-Auditing

Date: 2/14/2017 1:35:30 PM

Event ID: 4624

Task Category: Logon

Level: Information

Keywords: Audit Success

User: N/A

Computer: mpxxx.xxx.xxx.net

Description:

An account was successfully logged on.

Subject:

Security ID: SYSTEM

Account Name: MPxxx$

Account Domain: KIV

Logon ID: 0x3E7

Logon Information:

Logon Type: 7

Restricted Admin Mode: -

Virtual Account: No

Elevated Token: Yes

Impersonation Level: Impersonation

New Logon:

Security ID: UNIVERSE\mpxxx

Account Name: mpxxx

Account Domain: UNIVERSE

Logon ID: 0x3D5986

Linked Logon ID: 0x3D8CF3

Network Account Name: -

Network Account Domain: -

Logon GUID: {a97eb034-e1a9-beba-9e13-0376df13c092}

Process Information:

Process ID: 0x2cc

Process Name: C:\Windows\System32\lsass.exe

Network Information:

Workstation Name: MPxxx

Source Network Address: -

Source Port: -

Detailed Authentication Information:

Logon Process: Negotiat

Authentication Package: Negotiate

Transited Services: -

Package Name (NTLM only): -

Key Length: 0

SECOND DUPLICATED EVENT:

Log Name: Security

Source: Microsoft-Windows-Security-Auditing

Date: 2/14/2017 1:35:30 PM

Event ID: 4624

Task Category: Logon

Level: Information

Keywords: Audit Success

User: N/A

Computer: mpxxx.xxx.xxx.net

Description:

An account was successfully logged on.

Subject:

Security ID: SYSTEM

Account Name: MPxxx$

Account Domain: KIV

Logon ID: 0x3E7

Logon Information:

Logon Type: 7

Restricted Admin Mode: -

Virtual Account: No

Elevated Token: No

Impersonation Level: Impersonation

New Logon:

Security ID: UNIVERSE\mpxxx

Account Name: mpxxx

Account Domain: UNIVERSE

Logon ID: 0x3D8CF3

Linked Logon ID: 0x3D5986

Network Account Name: -

Network Account Domain: -

Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:

Process ID: 0x2cc

Process Name: C:\Windows\System32\lsass.exe

Network Information:

Workstation Name: MPxxx

Source Network Address: -

Source Port: -

Detailed Authentication Information:

Logon Process: Negotiat

Authentication Package: Negotiate

Transited Services: -

Package Name (NTLM only): -

Key Length: 0

The only difference is in "Elevated Token: and Logon GUID:" portion of output

Dear MS Guru please give me any ideas why this duplication happens. It is important for because I am planning to send events to third party security system and duplication makes a lot of unnecessary noise

Thank you.

 

Remote Login and New admin account created on my machine - hacked?

OK so a user named Lorenco was logged into my machine today when I went to login.

This user account should not exist and was connected remotely I believe

I captured all the event logs, what do I need to verify this was a hack or a legit login?

Received user logon notification on session 4.

shell\roaming\settingsync\settingprofilehandler.cpp(24)\SettingSync errors

event log cleared the user

The audit log was cleared.

Subject:

Security ID: GROD\Lorenco

Account Name: Lorenco

Domain Name: GROD

Logon ID: 0x46D9E82

A user's local group membership was enumerated.

Subject:

Security ID: GROD\Lorenco

Account Name: Lorenco

Account Domain: GROD

Logon ID: 0x46D9EA0

User:

Security ID: GROD\Lorenco

Account Name: Lorenco

Account Domain: GROD

Process Information:

Process ID: 0x2618

Process Name: C:\Users\Lorenco\Desktop\GoogleChromePortable\App\Chrome-bin\chrome.exe

Much more in the logs..