5

I'm seeing the following data for an event.

An account was logged off Security ID S-1-5-90-0-10
                           account name DWM-10 at 00:01:24 
                                        DWM-9  at  00:01:36
                           Security Id S-1-5-96-0-9            
                                       UMFD-9 at  00:01:36 logged off

Please explain what it means, especially when I did not log on?

Seth
  • 9,000
  • 1
  • 19
  • 34
Olga Khumlo
  • 51
  • 1
  • 1
  • 2
  • 1
    I edited the question to make your original formatting visible. It's been likely copied from the Windows Event log? In such a case consider adding EventIDs, Sources and such as they might provide more context. Also please review my edit whenever it suites what you meant. There are various [well known SIDs](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379649(v=vs.85).aspx) for Windows. This one doesn't seem to be listed. – Seth Jan 26 '18 at 10:54
  • @Seth it is indeed listed. The last three digits are randomly generated. – Ramhound Jan 26 '18 at 10:56
  • Your article is a bit better on this. You're correct that you can decode it but I was actually thinking about something like -500 for the administrator account. – Seth Jan 26 '18 at 11:03

2 Answers2

3

  • S-1-5-96-0-9

  • S-1-5-90-0-10

Both of these users are known system accounts. In this case, S-1-5, belongs to NT_AUTHORITY

A SID containing only the SECURITY_NT_AUTHORITY identifier authority.

Source: Well-Known SID Structures

Please explain what it means, especially when I did not log on?

Nothing unusual happened.

Ramhound
  • 41,734
  • 35
  • 103
  • 130
2

Accounts beginning with S-1-5-90-0 (account names DWM-x) are generated on the fly by the Desktop Window Manager component for its system services.

Accounts beginning with S-1-5-96-0 (account names UMFD-x) are generated on the fly by the User Mode Driver Framework component for its system services.

(Ordinary user accounts begin with S-1-5-21.)

The behaviour you're observing is perfectly normal.

Harry Johnston
  • 5,754
  • 7
  • 30
  • 55