locked
Multiple Sign Ins - Why? - Is it a virus? RRS feed

  • Question

  • I have Windows 10 Pro v1709 (OS Build: 16299.248) installed.

    Upgrade to 1709 occurred on 2/24/2018.

    I have four profiles defined.

    1. System Admin - Used for general system maintenance and other Admin requirements. About 1/mo or so.
    2. Standard Profile - Used for day-to-day activities.
    3. Family member - Part of Admin group, and others (to make sure I have a backup) - rarely used as family member is in the service and only comes home about 2 times a year.
    4. Family member - Rarely used, but provides access to other objects secured by my Standard Profile.

    Today (2/25/2018) I discovered (after a cold boot) that when I log in with either my Standard or my Admin account, both wind up being logged in.

    The first shown display is specific to:

    • Interactive Logon: Message title for users attempting to log in
    • Interactive Logon: Message text for users attempting to log in

    Found in Security Settings > Local Policies > Security Options.

    After first profile is signed in (either Admin or Standard User) The above display is shown a 2nd time, push the button OK, and it proceeds to log on to the profile that was initially selected.

    After logged in, then Start > Log in profile (where available users are listed) it is found that the other profile is also logged in (e.g. shows "signed in" message underneath the profile name.)

    It is logged in.

    Attempts to Shut Down from ONLY the profile needed results in the message "Others are logged in".

    The big question is why?

    • Does this mean that I have a key-logger running I don't know about (nor can detect)?
    • Does this mean that the system itself somehow "thinks" the other profile should also be logged in?

    Also, when I attempt to Log Off the selected profile, there is the occasional message that flashes so fast I can't retrieve it, yet it is a message indicating a hidden run object found within the registry somewhere. This is evident because, first it is wrapped in brackets ([]), and the "object" is then wrapped w/in the brackets using braces ({}). Format is like a registry key format (e.g. XXXX-XXXX-XXXX...)

    Any ideas why this his happening, or what has triggered it? Although I have a MS account (evident here), only one thing actually uses it: OneDrive. OneDrive is used only for specific purposes, and then through Office 365 subscribbed application. The apps w/in MS Office 365 require that my credentials be provided for each app, and they are.

    Thank you for any guidance or help that may be provided.

    Jim


    Jim - Mastiffs are the greatest!

    Sunday, February 25, 2018 6:42 PM

Answers

  • Hello Jim,

    I don't think that this is caused by virus.

    You can try the following method.

    1. Click the Start button, then select Settings > Accounts > Sign-in options.

    2. In the Privacy section, turn off Use my sign in info to automatically finish setting up my device after an update or restart.

    Additionally, please note that this is a forum for questions about Microsoft Advanced Threat Analytics, you can post your question to the following forum for getting better support.

    https://answers.microsoft.com/en-us/windows/forum/windows_10

    Best regards,

    Andy Liu


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Marked as answer by Jim.Low Friday, March 2, 2018 1:29 PM
    Monday, February 26, 2018 6:31 AM

All replies

  • Hello Jim,

    I don't think that this is caused by virus.

    You can try the following method.

    1. Click the Start button, then select Settings > Accounts > Sign-in options.

    2. In the Privacy section, turn off Use my sign in info to automatically finish setting up my device after an update or restart.

    Additionally, please note that this is a forum for questions about Microsoft Advanced Threat Analytics, you can post your question to the following forum for getting better support.

    https://answers.microsoft.com/en-us/windows/forum/windows_10

    Best regards,

    Andy Liu


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Marked as answer by Jim.Low Friday, March 2, 2018 1:29 PM
    Monday, February 26, 2018 6:31 AM
  • Andy, I appreciate the time and guidance.

    Should the recommended approach not work, I shall reach out to the forum suggested.

    Thank you again!

    Jim


    Jim - Mastiffs are the greatest!

    Monday, February 26, 2018 1:12 PM
  • This items was solved very easily and only with your assistance!

    I am very grateful!

    Jim


    Jim - Mastiffs are the greatest!

    Friday, March 2, 2018 1:29 PM
  • Hello Jim,

    You are welcome. 

    Glad to hear that the issue was resolved eventually.

    Best regards,

    Andy Liu


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, March 5, 2018 8:52 AM