Windows 7 Mysterious Windows Log offs

Neemobeer

Cloud Security Engineer

Staff member

Joined

Jul 4, 2015

Messages

8,998

• Jan 19, 2017

• #2

• Open event viewer
• Open the System log
• Filter the log for User32 events, it should tell you the process and user that is logging the systems out

Also are these systems on a Microsoft domain?

 

Upvote 0 Downvote

Evan Lewis

New Member

Joined

Jan 19, 2017

Messages

3

• Jan 19, 2017

• Thread Author
• #3

Thanks for your reply. I viewed the event logger but it didn't seem to reveal anything related to the log offs. It showed a history of what appear to be times I shut down or restarted the computer. I don't think these events correspond to log offs. The computer is on a network, I think it's a Microsoft domain? It allows people to access their individual user accounts (not really useful for these particular machines.)

 

Upvote 0 Downvote

Neemobeer

Cloud Security Engineer

Staff member

Joined

Jul 4, 2015

Messages

8,998

• Jan 19, 2017

• #4

If you open a command prompt and type systeminfo and look at the Domain and 'Logon Server' fields if the domain is something other than the computer name and 'Logon Server' is something like \\SERVERNAME then you're probably on a domain. If you are there are group policies that can be applied that log computers out. This would be setup by the IT department.

 

Upvote 0 Downvote

Solution

Evan Lewis

New Member

Joined

Jan 19, 2017

Messages

3

• Jan 19, 2017

• Thread Author
• #5

Thanks so much for your help. I'll try that. I think this might explain things. Its odd though how it only seems to affect some of the computers. I'll check.

 

Upvote 0 Downvote