Windows 10: Differences between Logons in Event History

My monitor was waking up at random intervals. By using a camera in the room, I recorded the times that the monitor wakes up and compared the events in Event History. I realized that the wake up times corresponded to Logons in Windows Logs - Security Events. There were other Logons and Special Logons which did not wake the system up, but some of these were waking the monitor up for some reason. I did not see any difference in the Logon information that did not wake the system up, and did wake the system up. Code: Subject: Security ID:SYSTEM Account Name:"""Computer Name""" Account Domain:"""Domain Name""" Logon ID:0x3E7 Logon Information: Logon Type:5 Restricted Admin Mode:- Virtual Account:No Elevated Token:Yes Impersonation Level:Impersonation New Logon: Security ID:SYSTEM Account Name:SYSTEM Account Domain:NT AUTHORITY Logon ID:0x3E7 Linked Logon ID:0x0 Network Account Name:- Network Account Domain:- Logon GUID:{00000000-0000-0000-0000-000000000000} Process Information: Process ID:0x230 Process Name:C:\Windows\System32\services.exe Network Information: Workstation Name:- Source Network Address:- Source Port:- Detailed Authentication Information: Logon Process:Advapi Authentication Package:Negotiate Transited Services:- Package Name (NTLM only):- Key Length:0 Why are some logons waking up my system and some others are not? How can I make sure that my system is secure and no one is seeing my monitor? (For example, Teamviewer is installed on my computer, but it is to see other computers, not this one. This one has no random password on it, it is disabled. There is nothing in teamviewer logs, or in Event History logs). How can I find out which process is waking up the computer? Is there any good network monitor that can log every in/out connection to the computer? (I tried Network Limiter, unfortunately, it does only show current connections, not the ips of past connections. I need a network monitor, that can show me the ip addresses (and machine addresses if possible) in a certain time period I specify. ) As an extra information, I checked and compared all of the logs in the Event History, and nothing matched up except some Logons. I checked the system with Windows and third party tools, nothing found. Only programs installed on the computer are known programs, such as TeamViewer. I am just not able to figure out why some Logons are waking the computer up. And I am not able to find a network monitor that can show me past connections with ip addresses. Thanks.

:)

 

Events 4672 & 4624 Win 10 Freezes - special LOGON ?

Hi,

Thank you for writing to Microsoft Community Forums.

1. Are you on a domain network?
   
2. May I know the make and the model number of your system?
   

The event logs you have provided seems to be the security logs that is generated when you login to your system. For more information on the event that was generated, you can check
4672(S): Special privileges assigned to new logon.

The Windows error logs will be located at Event Viewer > Windows Logs > System.

Please follow the step below and check if it works for you.

Step: Improve Windows 10 Performance.

Try some of the following suggestions to help
make your Windows 10 PC run better. The steps are listed in order, so start with the first one, see if that fixes the problem, and then continue to the next one if it doesn’t.

Note: The last step on the article contains Windows Reset, I suggest you not to perform Windows reset, as there is a change your data and applications will be wiped and also
the OS will reverted back to previous version you upgraded from.

If the issue still persists, please reply to this post with more information so that we can identify the root cause of this issue and assist you further.

Hope it helps.

Amit Sunar

Microsoft Community – Moderator

 

File History won't restore error message ‘'File History is saving Copies of your files for the first time’.

Hi,

Thanks for the reply and appreciate your efforts to work on this issue.

• Have you tried the option to restore the file or files to a different location?
  

Method A: Follow these steps:

1. Open "Settings" app.
   
2. Open "Update and Security".
   
3. Select "Backup" category.
   
4. Click "More options" under Backup using File History.
   
5. Scroll down to "Back up to a different drive".
   
6. Click "Stop using drive".
   
7. Go back to the main Backup window.
   
8. Click "Add a drive".
   
9. Select the new drive.
   

Method B: Instead of deleting the complete File History folder, suggest you to delete or empty the configuration folder under File History to check if that helps.

The File History configuration is located in the following location: ‘C:\Users\%username%\AppData\Local\Microsoft\Windows\FileHistory\Configuration folder’.

Once this is done, restart the computer and check the File History status.

Method C: There are chances that a file/files may be corrupt or damaged in the backup. Hence getting the error. The Windows Event Viewer shows a log of application and system messages, including errors, information messages, and warnings. It’s a useful
tool for troubleshooting all kinds of different Windows problems.

Events are placed in different categories, each of which is related to a log that Windows keeps on events regarding that category. While there are a lot of categories, the vast amount of troubleshooting you might want to do pertains to three of them:

Application: The Application log records events related to Windows system components, such as drivers and built-in interface elements.

System: The System log records events related to programs installed on the system.

Security: When security logging is enabled (it’s off by default in Windows), this log records events related to security, such as logon attempts and resource access.

Press Windows key + X and click on Event Viewer.

Hope this helps and let us know how it goes.

Regards,

Srimadhwa B

Microsoft Community-Moderator

 

I want to lookover the logon history of workstation including logon and logout times for all user accounts as the event viewer was lock by server administrator

- logon history of workstation including logon and logout times for all user accounts

- the event viewer was lock by server administrator

-control panel was lock by administor