3
1
I'm seeing the following data for an event.
An account was logged off Security ID S-1-5-90-0-10
account name DWM-10 at 00:01:24
DWM-9 at 00:01:36
Security Id S-1-5-96-0-9
UMFD-9 at 00:01:36 logged off
Please explain what it means, especially when I did not log on?
1
I edited the question to make your original formatting visible. It's been likely copied from the Windows Event log? In such a case consider adding EventIDs, Sources and such as they might provide more context. Also please review my edit whenever it suites what you meant. There are various well known SIDs for Windows. This one doesn't seem to be listed.
– Seth – 2018-01-26T10:54:37.697@Seth it is indeed listed. The last three digits are randomly generated. – Ramhound – 2018-01-26T10:56:46.410
Your article is a bit better on this. You're correct that you can decode it but I was actually thinking about something like -500 for the administrator account. – Seth – 2018-01-26T11:03:03.553