5

I'm seeing the following data for an event.

An account was logged off Security ID S-1-5-90-0-10
                           account name DWM-10 at 00:01:24 
                                        DWM-9  at  00:01:36
                           Security Id S-1-5-96-0-9            
                                       UMFD-9 at  00:01:36 logged off

Please explain what it means, especially when I did not log on?

Seth
  • 9,393
Olga Khumlo
  • 51

2 Answers2

3

  • S-1-5-96-0-9

  • S-1-5-90-0-10

Both of these users are known system accounts. In this case, S-1-5, belongs to NT_AUTHORITY

A SID containing only the SECURITY_NT_AUTHORITY identifier authority.

Source: Well-Known SID Structures

Please explain what it means, especially when I did not log on?

Nothing unusual happened.

Ramhound
  • 44,080
2

Accounts beginning with S-1-5-90-0 (account names DWM-x) are generated on the fly by the Desktop Window Manager component for its system services.

Accounts beginning with S-1-5-96-0 (account names UMFD-x) are generated on the fly by the User Mode Driver Framework component for its system services.

(Ordinary user accounts begin with S-1-5-21.)

The behaviour you're observing is perfectly normal.

Harry Johnston
  • 5,914
  • 8
  • 34
  • 58