Windows 10: Win 10 keep Audit even not on PC

Is it normal when your computer keep activities after you go to sleep but still keep your Window 10 on? Yesterday i try to download some stuffs on my PC and forgot to turn it off.The next morning I open Event viewer an see there are some strange activities in Security Log in the time i'm not on the PC. Event ID are : 4624, 4672, 5379.


The log detail :


An account was successfully logged on.



Subject:

Security ID: SYSTEM

Account Name: DESKTOP-RPDVPC8$

Account Domain: WORKGROUP

Logon ID: 0x3E7



Logon Information:

Logon Type: 5

Restricted Admin Mode: -

Virtual Account: No

Elevated Token: Yes



Impersonation Level: Impersonation



New Logon:

Security ID: SYSTEM

Account Name: SYSTEM

Account Domain: NT AUTHORITY

Logon ID: 0x3E7

Linked Logon ID: 0x0

Network Account Name: -

Network Account Domain: -

Logon GUID: {00000000-0000-0000-0000-000000000000}



Process Information:

Process ID: 0x294

Process Name: C:\Windows\System32\services.exe



Network Information:

Workstation Name: -

Source Network Address: -

Source Port: -



Detailed Authentication Information:

Logon Process: Advapi

Authentication Package: Negotiate

Transited Services: -

Package Name (NTLM only): -

Key Length: 0



This event is generated when a logon session is created. It is generated on the computer that was accessed.



The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.



The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).



The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.



The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.



The impersonation level field indicates the extent to which a process in the logon session can impersonate.



The authentication information fields provide detailed information about this specific logon request.

- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.

- Transited services indicate which intermediate services have participated in this logon request.

- Package name indicates which sub-protocol was used among the NTLM protocols.

- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.



could someone else explain for me? Is my PC being hijack when i'm sleeping or that are just normal activities in window

:)

 

Audit mode

Hi Diane,

Windows boots into Windows Welcome Mode and Audit Mode. Windows Welcome Mode
is the first user experience while the Audit mode is used to add customization to Windows images. Sometimes, Windows keeps running in Audit Mode and user has no idea about it, just like in your case. While your machine is running Audit
Mode when upgrading or reinstalling Windows 10, the upgrade won’t progress.

Here's how to exit from Audit mode to reinstall Windows 10:

• Open the administrative or elevated Command Prompt. Type cmd in the
  Search field at the taskbar.
• Type the following command and press Enter key: sysprep /oobe /generalize
  DISCLAIMER: Running sysprep command each time resets Windows licensing state to default. So if your Windows is activated and you run this command, you’ll need to reactivate Windows after executing this command.
  
  
• Once the command IS successfully executed, you’ll be out of Audit Mode. Now you can re-try to upgrade to Windows 10 and it should work.

Let us know if the steps above worked for you.

 

Is there a way I can add "Edit with Photoshop" and "Edit with Audition" to my context menu?

Hi,

I realize that you want to add "Edit with Photoshop" and "Edit with Audition" to my context menu when you right click a file. I will try to help you with this issue.

Please answer these questions to get more clarity on this issue:

• 
  Do you have Adobe Photoshop and Adobe Audition program installed on the PC?
  
• 
  Do you have both audio and video on the file?
  

Suggest you to install Adobe Audition program on the PC to check if you get that option when you right-click that file.

Keep us informed to help you further.

Thank you.

 

Windows 10 Profssional 10 1809 osBuild 17763-134 Window Security Auditing

Hi,

Thank you for writing to Microsoft Community Forums.

1. What is the model number of the device?
   
2. Is your computer connected to Domain Network?
   

Security auditing is one of the most powerful tools that you can use to maintain the integrity of your system. As part of your overall security strategy, you should determine
the level of auditing that is appropriate for your environment. Auditing should identify attacks (successful or not) that pose a threat to your network, and attacks against resources that you have determined to be valuable in your risk assessment.

You may refer the article Security Auditing
and Basic security audit policy settings for
more information.

If the computer is not on a Domain network, proceed with the below suggested steps

Start your PC in safe mode. Refer the article on how to start your
PC in Safe mode in Windows 10. If the issue is fixed in Safe mode, try to check in
clean boot.

Note: A ‘clean boot’ starts Windows with a minimal set of drivers and startup programs, so that you can determine whether a background program is interfering with your game or program.

Your computer may temporarily lose some functionality while in a clean boot environment, however, that functionality will return when you reset the computer to start normally after you have finished your troubleshooting.

You may refer the article on how
to perform a clean boot in Windows.

Refer the section How to determine what is causing the problem after you do a clean boot, if your device is working fine in clean boot.

Also refer the section Reset the computer to start normally after clean boot troubleshooting.

If the computer is on a Domain network, you can contact your IT administrator or you can post your query in

TechNet Forums.

Hope it helps.

Muralidhar

Microsoft Community Moderator