0
I have this showing (computername removed) is the results from logonsessions tool from sysinternals - although when I check in taskmgr for anything related to the administrator no remote (rdp) sessions nor any processes running from administrator,
can anyone offer an explanation except stealth hack???
[4] Logon session 00000000:00fcb807:
User name: \Administrator
Auth package: Kerberos
Logon type: RemoteInteractive
Session: 9
Sid: S-1-5-21-166797382-3125802628-3585296827-500
Logon time: 6/08/2019 3:21:30 PM
Logon server: {COMPUTERNAME}
DNS Domain: {DOMAINNAME}.LOCAL
UPN: Administrator@{DOMAINNAME}local