Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The other day I was sitting on my Windows 7 workstation and suddenly got kicked out to the switch user screen, showing my main and only account as being logged in. This is typical if I remote desktop into my workstation, so I was immediately worried that someone (not me) had logged into my computer via remote desktop. I checked the Windows Event viewer, and I'm having a hard time making sense of what it is showing. Can anyone tell me what these events mean?

The time I was on the computer was 11:15pm, and you can see the timestamps on the screenshot below showing 1:00am and 4:00am.

enter image description here

share|improve this question
The special logins are likely from an elevated system process performing a background task, such as a defrag. Not sure about the logoff problem though. –  DanBig Feb 28 '13 at 17:35
See serverfault.com/questions/121399/… and serverfault.com/questions/312928/… (possible duplicate?) –  Freddie Witherden Feb 28 '13 at 19:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.