I'm seeing the following data for an event.

An account was logged off Security ID S-1-5-90-0-10 account name DWM-10 at 00:01:24 DWM-9 at 00:01:36 Security Id S-1-5-96-0-9 UMFD-9 at 00:01:36 logged off

Please explain what it means, especially when I did not log on?

3

2 Answers

• S-1-5-96-0-9

• S-1-5-90-0-10

Both of these users are known system accounts. In this case, S-1-5, belongs to NT_AUTHORITY

A SID containing only the SECURITY_NT_AUTHORITY identifier authority.

Source: Well-Known SID Structures

Please explain what it means, especially when I did not log on?

Nothing unusual happened.

0

Accounts beginning with S-1-5-90-0 (account names DWM-x) are generated on the fly by the Desktop Window Manager component for its system services.

Accounts beginning with S-1-5-96-0 (account names UMFD-x) are generated on the fly by the User Mode Driver Framework component for its system services.

(Ordinary user accounts begin with S-1-5-21.)

The behaviour you're observing is perfectly normal.

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password Submit

Post as a guest

Post Your Answer Discard

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy