Windows 10: Strange message at restart and shutdown...

I have a Windows 10 Pro 64-bit system, updated from Windows 8.1 about two weeks ego, wired connection assigned to a workgroup. The system works just fine with one exception. At the time of restart/shutdown, the system may display the following message:

This message is more prevalent, if the restart/shutdown initiated right after login, or even prior to login, but shows up after 8-10 using the system and initiating a shutdown. My knee-jerk reaction was that the system has some malware, but had not been able to locate any. Admittedly, it does not mean the system has none...
Actions taken so far:

• Scan system with Viper, Malwarebytes and Emisoft security software, came up empty
• Scan system off-line via Kaspersky and BitDefender, came up empty

Disconnecting the PC from the network, for the purpose of eliminating remote connections to the PC, did not make the message go away. Evidently, this is a local logon by some process and/or scheduled task.
The disabled UIDs are:

• Adminstrator
• DefaultAccount
• Guest
• WDAGUtilityAccount

The enabled UIDs are:

• UID1, standard user account
• UID2, standard user account
• UID3, local administarator account

The message is coming from the file named "authui.dll":
Windows 10 DLL File Information - authui.dll
Reviewing the security event did not show any unknown account and the Task Scheduler shows mainly Windows scheduled tasks, with a few third-party application schedules.
Reinstalling windows isn't really an option, one of the reasons for the update is to preserve the application and user data.
Does anyone have an idea what triggers this message and how to get rid of it?
TIA...

:)

 

Error Message at shutdown or restart

these messages when I shutdown or restart the computer

680000cf-10d3-4ad047-9e02d4b44362 This app is preventing you from restarting

G

This app is preventing you from restarting



Do I need to worry about this ?

And can I fix it?

Alby

 

Error Message at shutdown or restart

Nielsen online application.

No need to worry. Ignore it.

 

From Task Manager click Users tab, make sure your user account is the only user account that is login if there are any other user accounts disconnect them by right clicking user account and select Disconnect.

 

I've noticed that even if a remote session isn't active when I log out, sometimes just having run one while I've been logged in is enough to provoke that message when I log out or restart. And for sure, an active RDP session at that time will also provoke that message.
HTH,
--Ed--

 

Thank you for the suggestions...

There are no other user accounts, only the "UID1, standard account" logged on to the system when checked.

The RDP connections are disabled to this system, one of the first possible source I've looked at.

I am not certain, if having the Windows Firewall Control on the system may have something to do with this? A number of Windows processes are blocked, for example:

And so on...

These are no issues with not allowing connections, the system runs just fine. Other than some errors are being generated in the event viewer about the lack of connectivity....

The Current Ports utility only shows known connections, in an other word, all connections are verified to the applications and the process path. There's no "unknown" connections...

 

@Cr00zng, it's probably not malware.

The Fall Creators Update (1709) quietly introduced a new feature such that certain apps that are capable of registering for the service will be reopened at the next boot. Apparently this can sometimes have the effect that other users that were signed in at shutdown will be 'pre-signed in' at the next start up, causing the message you have seen.

on a restart Fall Creators Update reopens apps from before

Logout warning "Someone else is still using this pc"

 

Great explanation, Bree: nice work in connecting those dots. We who follow the forums have known about this more or less since FCU emerged, but I hadn't really stopped to think that such 'pre-signed in' services would register on par with user accounts. Makes perfect sense when you do (stop to think, that is ;-).
Thanks again,
--Ed--

 

Yes, it seems that after the FCU some configurations report several users logged in after a restart, as in my second link and this one. I haven't been able to reproduce this myself, so haven't been able to diagnose further. The next release of Windows 10 (1803?) is apparently going to have a way to turn this feature off.

https://blogs.windows.com/windowsexp...SEUrvYxoVKQ.97

In the mean time, turning off 'Use my sign-in info to automatically finish setting my device after an update or restart' for each of the 'stealth' users may help.

 

After all of the testing and feedback on this forum, I am convinced that it is not malware; it is a "feature"...

Your statements and links make a lot of sense, thanks...

On the other hand, the FCU changes make no sense; it has limited value and will cause "knee-jerk" reactions. At least for people, who pay attention to messages. At the very least, MS should have more descriptive message, instead of just a generic multiple user logon message. Oh well, there are more processes to block either by the firewall, or just stop starting up...

Thank you for the replies guys and galls....

 

Yes, a lot of people have been upset by this unannounced new 'feature' - hence the partial backtrack by Microsoft starting with the Insider build 17040. Hopefully this 'fix' (or something like it) will make its way into the next public release in April.

In the mean time, you can shut down or restart the 'traditional' way by clicking on the desktop and using the Alt+F4 menu which should eliminate the 'extra users' problem at the next boot.

 

Good advise that will work in most cases, but...

This system is imaged every night, the Alt+F4 is really not an option...