Windows 10: Tracing the source spurious of logon attempts emmanating from a desktop PC

I'm stumped on this. It's been plaguing my desktop for a year or more and I'm getting Wazuh reports about it. The symptom is perhaps best summarised by an anonymised Security log entry:A logon was attempted using explicit credentials.Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x144C5 Logon GUID: {00000000-0000-0000-0000-000000000000}Account Whose Credentials Were Used: Account Name: an_admin_account_that_does_not_even_exist_but_did_some_years_ago Account Domain: US L

:)

 

PC STUCK ON LOGON SCREEN

Hello Vasanth,

Thank you for posting in Microsoft Community, we appreciate your interest in Windows 10.

I understand the inconvenience as your are unable to logon to the computer, we will help you to resolve this issue.

I suggest you to enable built-in administrator account from safe mode, log-in with that account and troubleshoot the current user account.

Step 1: Start computer in safe mode.

• 
  Type Settings in the search box on the desktop, select
  Settings.
  
• 
  Here select Change pc settings and then
  General.
  
• 
  Scroll down to Advanced startup, click
  Restart now.
  
• 
  Click on Troubleshoot, Advanced options, and Startup Settings.
  
• 
  Click Restart, select Safe mode and then press
  Enter.
  

Step 2: Try to login to your temporary user account, enable built in administrator account and try to change the account settings.

• 
  Press Windows + X key together on your desktop screen.
  
• 
  Click on Command Prompt (admin) to open
  Command Prompt.
  
• 
  Type the following command and hit Enter:
  

• 
  net user administrator /active: yes
  (Check for the spaces)
  

4. Now log off from the current user and try to login to the administrator account that is enabled.

Note: Please follow the same steps and type net user administrator /active: no to disable admin account after the troubleshooting is done.

Step 3: I suggest you toRun Microsoft Account Troubleshooter
and check.

Link: Microsoft Account
troubleshooter

Please do get back to us with the status of this issue. We will be happy to assist you further, if the issue still persist.

 

Source to use for DISM on Windows 10

This is not completely true. The suggestion is to download the Techbench version and use DISM to apply to install.wim directly. However, you can also use the version download from MCT except it will involve an extra step as follows:

1. Use the latest version of 7-Zip to extract the content of install.esd. For example: to a folder xxx on the desktop
2. From Admin command prompt:
   Dism /Online /Cleanup-Image /RestoreHealth /Source:%USERPROFILE%\Desktop\xxx\windows /LimitAccess

See screen shot, the contents of install.wim and install.esd are exactly the same.

 

Windows 10 logon requires 2 separate logons

It would be quite a deliberate "accident" to set a BIOS password because you actually need to get into BIOS to set it! Removing it requires the same steps: Get into the BIOS, then clear the password.

If you do not remember the BIOS password then there are two options:

• If this is a desktop PC then you need to open the case and remove the shiny button cell battery from the motherboard for 10 minutes. This will clear the BIOS password.
• If this is a laptop then you need to return it to the distributor.