Mysterious Log-ins

[Steven]

In the security portion of my event viewer there are
login/logouts under the user names Guest (even though the
Guest account is deactivted) and the other is S-1-5-21-
1547161642-1677128483-1343024091-1007. The Guest one is a
type 3 over the network, and the s-1-5-21... one is a
type 2 on this computer. any ideas?

 

[Eric Fitzgerald [MSFT]]

Is your machine domain-joined? If not, are you using Simple File Sharing?

If you are getting successful logons for Guest, then Guest was enabled at
the time. Login type "3" means network, Login type "2" means interactive
(at the console).

When a SID is shown instead of a name, it usually means either the trust has
failed/was broken to the domain the account is in, or the workstation has
been disjoined from the domain.

Eric

--
Eric Fitzgerald
Program Manager, Windows Auditing
Microsoft Corporation

The above message is provided "AS-IS" with no warranties, and confers no
rights.