3
1
I'm seeing the following data for an event.
An account was logged off Security ID S-1-5-90-0-10
account name DWM-10 at 00:01:24
DWM-9 at 00:01:36
Security Id S-1-5-96-0-9
UMFD-9 at 00:01:36 logged off
Please explain what it means, especially when I did not log on?
Olga Khumlo
Posted 2018-01-26T10:41:53.750
Reputation: 31
2
S-1-5-96-0-9
S-1-5-90-0-10
Both of these users are known system accounts. In this case, S-1-5, belongs to NT_AUTHORITY
A SID containing only the SECURITY_NT_AUTHORITY identifier authority.
Source: Well-Known SID Structures
Please explain what it means, especially when I did not log on?
Nothing unusual happened.
Ramhound
Posted 2018-01-26T10:41:53.750
Reputation: 28 517
0
Accounts beginning with S-1-5-90-0 (account names DWM-x) are generated on the fly by the Desktop Window Manager component for its system services.
Accounts beginning with S-1-5-96-0 (account names UMFD-x) are generated on the fly by the User Mode Driver Framework component for its system services.
(Ordinary user accounts begin with S-1-5-21.)
The behaviour you're observing is perfectly normal.
Harry Johnston
Posted 2018-01-26T10:41:53.750
Reputation: 5 054
1
I edited the question to make your original formatting visible. It's been likely copied from the Windows Event log? In such a case consider adding EventIDs, Sources and such as they might provide more context. Also please review my edit whenever it suites what you meant. There are various well known SIDs for Windows. This one doesn't seem to be listed.
– Seth – 2018-01-26T10:54:37.697@Seth it is indeed listed. The last three digits are randomly generated. – Ramhound – 2018-01-26T10:56:46.410
Your article is a bit better on this. You're correct that you can decode it but I was actually thinking about something like -500 for the administrator account. – Seth – 2018-01-26T11:03:03.553