Windows 8 and 8.1 Forums


Event Viewer showing unauthorized logons?

  1. #1


    Posts : 2
    Windows 8

    Event Viewer showing unauthorized logons?


    Today I just got back to my apartment from an weekend out of town. When I logged into Windows 8, I noticed that some programs were running what really shouldn't be. I checked the Event Viewer and saw a series of logon events that happened while I was not home.
    Before I left for the weekend, I didn't shutdown the laptop but I closed the lid so any one wishing to use it must enter a password to login to Windows, and I am the only person that knows the password. The strange logon events recorded on Event Viewer made me suspicious of my roommates. I don't want to start questioning them at this point. Could someone help me understand what was happening to my computer when I was away? Thank you very much.
    Here's the security log for when I was away:

    Audit Success 2016-02-21 2:50:17 PM Microsoft Windows security auditing. 4672 Special Logon
    Audit Success 2016-02-21 2:50:17 PM Microsoft Windows security auditing. 4624 Logon
    Audit Success 2016-02-21 2:50:17 PM Microsoft Windows security auditing. 4672 Special Logon
    Audit Success 2016-02-21 2:50:17 PM Microsoft Windows security auditing. 4624 Logon
    Audit Success 2016-02-21 2:49:15 PM Microsoft Windows security auditing. 4672 Special Logon
    Audit Success 2016-02-21 2:49:15 PM Microsoft Windows security auditing. 4624 Logon
    Audit Success 2016-02-21 2:48:56 PM Microsoft Windows security auditing. 4672 Special Logon
    Audit Success 2016-02-21 2:48:56 PM Microsoft Windows security auditing. 4624 Logon
    Audit Success 2016-02-21 9:42:25 AM Microsoft Windows security auditing. 4672 Special Logon
    Audit Success 2016-02-21 9:42:25 AM Microsoft Windows security auditing. 4624 Logon
    Audit Success 2016-02-21 9:41:17 AM Microsoft Windows security auditing. 4672 Special Logon
    Audit Success 2016-02-21 9:41:17 AM Microsoft Windows security auditing. 4624 Logon
    Audit Success 2016-02-21 2:51:55 AM Microsoft Windows security auditing. 4672 Special Logon
    Audit Success 2016-02-21 2:51:55 AM Microsoft Windows security auditing. 4624 Logon
    Audit Success 2016-02-21 2:51:39 AM Microsoft Windows security auditing. 4672 Special Logon
    Audit Success 2016-02-21 2:51:39 AM Microsoft Windows security auditing. 4624 Logon
    Audit Success 2016-02-21 2:50:20 AM Microsoft Windows security auditing. 4672 Special Logon
    Audit Success 2016-02-21 2:50:20 AM Microsoft Windows security auditing. 4624 Logon
    Audit Success 2016-02-21 2:50:19 AM Microsoft Windows security auditing. 4672 Special Logon
    Audit Success 2016-02-21 2:50:19 AM Microsoft Windows security auditing. 4624 Logon
    Audit Success 2016-02-20 8:14:10 PM Microsoft Windows security auditing. 4672 Special Logon
    Audit Success 2016-02-20 8:14:10 PM Microsoft Windows security auditing. 4624 Logon
    Audit Success 2016-02-20 2:50:09 PM Microsoft Windows security auditing. 4672 Special Logon
    Audit Success 2016-02-20 2:50:09 PM Microsoft Windows security auditing. 4624 Logon
    Audit Success 2016-02-20 2:50:09 PM Microsoft Windows security auditing. 4672 Special Logon
    Audit Success 2016-02-20 2:50:09 PM Microsoft Windows security auditing. 4624 Logon
    Audit Success 2016-02-20 2:48:50 PM Microsoft Windows security auditing. 4672 Special Logon
    Audit Success 2016-02-20 2:48:50 PM Microsoft Windows security auditing. 4624 Logon
    Audit Success 2016-02-20 2:48:19 PM Microsoft Windows security auditing. 4672 Special Logon
    Audit Success 2016-02-20 2:48:19 PM Microsoft Windows security auditing. 4624 Logon
    Audit Success 2016-02-20 1:42:48 PM Microsoft Windows security auditing. 4672 Special Logon
    Audit Success 2016-02-20 1:42:48 PM Microsoft Windows security auditing. 4624 Logon
    Audit Success 2016-02-20 1:42:14 PM Microsoft Windows security auditing. 4672 Special Logon
    Audit Success 2016-02-20 1:42:14 PM Microsoft Windows security auditing. 4624 Logon
    Audit Success 2016-02-20 2:50:50 AM Microsoft Windows security auditing. 4672 Special Logon
    Audit Success 2016-02-20 2:50:50 AM Microsoft Windows security auditing. 4624 Logon
    Audit Success 2016-02-20 2:50:26 AM Microsoft Windows security auditing. 4672 Special Logon
    Audit Success 2016-02-20 2:50:26 AM Microsoft Windows security auditing. 4624 Logon
    Audit Success 2016-02-20 2:50:09 AM Microsoft Windows security auditing. 4672 Special Logon
    Audit Success 2016-02-20 2:50:09 AM Microsoft Windows security auditing. 4624 Logon
    Audit Success 2016-02-20 2:50:08 AM Microsoft Windows security auditing. 4672 Special Logon
    Audit Success 2016-02-20 2:50:08 AM Microsoft Windows security auditing. 4624 Logon

      My System SpecsSystem Spec

  2. #2


    Did you get an answer?
      My System SpecsSystem Spec

  3. #3


    Posts : 2
    Windows 8


    No I haven't got an answer yet.
      My System SpecsSystem Spec

  4. #4


    This may shed some light on it for you,

    Event viewer - special Logon - NT Authority - Windows 7

    I have a bunch of those too,

    Click image for larger version

    I don't think you need to worry about them.
      My System SpecsSystem Spec

Event Viewer showing unauthorized logons?
Related Threads
How to identify Unauthorized access from event log? in User Accounts and Family Safety
I had left my laptop in college lab after locking it. Not sure if I had left it in sleep mode. Today when I checked the event log has an entry at a time I wasn't there!The system has returned from a low power state. I left the lab at 12:30. Log has an entry in power troubleshooter at 12:32. ...
59591 Would anyone have the time to look at the attached photo which shows a list of issues that are showing up in Event Viewer. What do they mean, how do I deal with them? Why are they happening? I had a catastrophic failure a few weeks ago and had to do a complete re-install on Windows 8,...
Event Viewer - Event Log Online Help in Performance & Maintenance
Hi, I am new to the forum and have searched to see if I can find a fix for my issue. My issue is whenever I use the Event Log Online Help link in any Event Notification all I get is transferred to this page Page Not Found I am new to Windows 8 but I used this service regularly with XP. I...
keep getting it logged as an error. I have gone into Adjust Date and Time\Internet Time\and it is set to automatically synchronize with time.windows.com and on a scheduled basis. When I try to update or change the setting I get an error message that an error occurred while windows was...
Event viewer id help please in Performance & Maintenance
hi guys, I have had windows 8 installed for about 4 days now and I just looked in event viewer and there are lots of kernel power and kernel pnp warnings and errors. event id 137 says. . . The system firmware has changed the processor's memory type range registers (MTRRs) across a sleep...
While playing war thunder on steam my screen went black and i couldn't do anything. I restart my computer and play again it crashes. After one more time i look at my event viewer and find critical error event ID:41. I don't whether its the game or my pc.
I've noticed an intriguing event in Event viewer... Log Name: Application Source: Microsoft-Windows-Security-SPP Date: 25. 1. 2013. 8:13:00 PM Event ID: 8208 Task Category: None Level: Error Keywords: Classic User: N/A
Eight Forums Android App Eight Forums IOS App Follow us on Facebook