Hi guys, I have a few questions. I left my computer in sleep mode (I have password protected account), and I live with crazy roommates. I left it like that on 1.9. during the night.
On 2.9 during whole day I was away, left my computer in my room.
I began suspecting that they have invaded my laptop during that day due to one thing. So I checked event viewer, security log. I talked with friend of mine, he told me to look for event ID 4648, that one shows whether someone has logged in into your computer using password credentials,I have found out that nobody during that time. I am still not calm though.
I checked other security logs that happened during that day, since the moment I put my computer in sleep mode, there have been processes running in the background, at night at 2:30 I had mix of 4624+4672, and since then, there have been always 4 system ingegrity event ids 5062 exchanging with 1x logon 4624, and 1x special logon 4672, every couple hours till the moment I came home in the evening and logged in.
So, question is:
1. If I have password protected computer, does that mean that it will require password each and every time, no exceptions, when someone opens computer and recovers it from sleep mode?
2. Is it possible for 4624 and 4672 event ids in Security log, at the moment they happen,and perhaps a few seconds/minutes later, since they mean Log on and Special log on to "break" the log in screen, and if someone opened my laptop at that moment to be actually logged in? Without need to put in the password?
3. At one suspicious time I had also in Application log event id: 1005. - Customer Experience Improvement Program. What does it mean and does this event happen only when computer is logged in for real, or is it some background process that happened during sleep mode?
Thanks a lot. Have a nice day.
On 2.9 during whole day I was away, left my computer in my room.
I began suspecting that they have invaded my laptop during that day due to one thing. So I checked event viewer, security log. I talked with friend of mine, he told me to look for event ID 4648, that one shows whether someone has logged in into your computer using password credentials,I have found out that nobody during that time. I am still not calm though.
I checked other security logs that happened during that day, since the moment I put my computer in sleep mode, there have been processes running in the background, at night at 2:30 I had mix of 4624+4672, and since then, there have been always 4 system ingegrity event ids 5062 exchanging with 1x logon 4624, and 1x special logon 4672, every couple hours till the moment I came home in the evening and logged in.
So, question is:
1. If I have password protected computer, does that mean that it will require password each and every time, no exceptions, when someone opens computer and recovers it from sleep mode?
2. Is it possible for 4624 and 4672 event ids in Security log, at the moment they happen,and perhaps a few seconds/minutes later, since they mean Log on and Special log on to "break" the log in screen, and if someone opened my laptop at that moment to be actually logged in? Without need to put in the password?
3. At one suspicious time I had also in Application log event id: 1005. - Customer Experience Improvement Program. What does it mean and does this event happen only when computer is logged in for real, or is it some background process that happened during sleep mode?
Thanks a lot. Have a nice day.
Facebook
Twitter
Instagram