Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The other day I was sitting on my Windows 7 workstation and suddenly got kicked out to the switch user screen, showing my main and only account as being logged in. This is typical if I remote desktop into my workstation, so I was immediately worried that someone (not me) had logged into my computer via remote desktop. I checked the Windows Event viewer, and I'm having a hard time making sense of what it is showing. Can anyone tell me what these events mean?

The time I was on the computer was 11:15pm, and you can see the timestamps on the screenshot below showing 1:00am and 4:00am.

enter image description here

share|improve this question
The special logins are likely from an elevated system process performing a background task, such as a defrag. Not sure about the logoff problem though. – DanBig Feb 28 '13 at 17:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.