Strange message at restart and shutdown...

I have a Windows 10 Pro 64-bit system, updated from Windows 8.1 about two weeks ego, wired connection assigned to a workgroup. The system works just fine with one exception. At the time of restart/shutdown, the system may display the following message:

"If you shut down now, you and any other people using this PC could lose unsaved work."

This message is more prevalent, if the restart/shutdown initiated right after login, or even prior to login, but shows up after 8-10 using the system and initiating a shutdown. My knee-jerk reaction was that the system has some malware, but had not been able to locate any. Admittedly, it does not mean the system has none...
Actions taken so far:

1. Scan system with Viper, Malwarebytes and Emisoft security software, came up empty
2. Scan system off-line via Kaspersky and BitDefender, came up empty

Disconnecting the PC from the network, for the purpose of eliminating remote connections to the PC, did not make the message go away. Evidently, this is a local logon by some process and/or scheduled task.
The disabled UIDs are:

• Adminstrator
• DefaultAccount
• Guest
• WDAGUtilityAccount

The enabled UIDs are:

• UID1, standard user account
• UID2, standard user account
• UID3, local administarator account

The message is coming from the file named "authui.dll":
Windows 10 DLL File Information - authui.dll
Reviewing the security event did not show any unknown account and the Task Scheduler shows mainly Windows scheduled tasks, with a few third-party application schedules.
Reinstalling windows isn't really an option, one of the reasons for the update is to preserve the application and user data.
Does anyone have an idea what triggers this message and how to get rid of it?
TIA...

From Task Manager click Users tab, make sure your user account is the only user account that is login if there are any other user accounts disconnect them by right clicking user account and select Disconnect.

Thank you for the suggestions...

There are no other user accounts, only the "UID1, standard account" logged on to the system when checked.

The RDP connections are disabled to this system, one of the first possible source I've looked at.

I am not certain, if having the Windows Firewall Control on the system may have something to do with this? A number of Windows processes are blocked, for example:

12/13/2017 12:28:12 PM | 4776 | Host Process for Windows Services | C:\windows\system32\svchost.exe | Block | Out | "local IP" | 51036 | 131.253.34.230 | 443 | 6

12/13/2017 12:09:55 PM | 3880 | Windows Problem Reporting | C:\windows\system32\wermgr.exe | Block | Out | "local IP" | 50860 | 65.55.252.202 | 443 | 6


12/13/2017 12:15:51 PM | 3348 | Speech Runtime Executable | C:\windows\system32\speech_onecore\common\speechruntime.exe | Block | Out | "local host IP" | 50947 | 65.55.44.108 | 443 | 6*


*-This system doesn't have a microphone...

And so on...

These are no issues with not allowing connections, the system runs just fine. Other than some errors are being generated in the event viewer about the lack of connectivity....

The Current Ports utility only shows known connections, in an other word, all connections are verified to the applications and the process path. There's no "unknown" connections...

Cr00zng said:

...My knee-jerk reaction was that the system has some malware...
...Does anyone have an idea what triggers this message and how to get rid of it?

@Cr00zng, it's probably not malware.

The Fall Creators Update (1709) quietly introduced a new feature such that certain apps that are capable of registering for the service will be reopened at the next boot. Apparently this can sometimes have the effect that other users that were signed in at shutdown will be 'pre-signed in' at the next start up, causing the message you have seen.

on a restart Fall Creators Update reopens apps from before

Logout warning "Someone else is still using this pc"

Yes, it seems that after the FCU some configurations report several users logged in after a restart, as in my second link and this one. I haven't been able to reproduce this myself, so haven't been able to diagnose further. The next release of Windows 10 (1803?) is apparently going to have a way to turn this feature off.

Microsoft said:

Based on your feedback, the feature to restore applications that have registered for application restart after you reboot or shutdown (through power options available on the Start Menu and various other locations) has been set to only occur for users that have enabled “Use my sign-in info to automatically finish setting my device after an update or restart” in the Privacy section under Sign-in Options Settings.

https://blogs.windows.com/windowsexp...SEUrvYxoVKQ.97

In the mean time, turning off 'Use my sign-in info to automatically finish setting my device after an update or restart' for each of the 'stealth' users may help.

Bree said:

@Cr00zng, it's probably not malware.

After all of the testing and feedback on this forum, I am convinced that it is not malware; it is a "feature"...

The Fall Creators Update (1709) quietly introduced a new feature such that certain apps that are capable of registering for the service will be reopened at the next boot. Apparently this can sometimes have the effect that other users that were signed in at shutdown will be 'pre-signed in' at the next start up, causing the message you have seen.

on a restart Fall Creators Update reopens apps from before

Logout warning "Someone else is still using this pc"

Your statements and links make a lot of sense, thanks...

On the other hand, the FCU changes make no sense; it has limited value and will cause "knee-jerk" reactions. At least for people, who pay attention to messages. At the very least, MS should have more descriptive message, instead of just a generic multiple user logon message. Oh well, there are more processes to block either by the firewall, or just stop starting up...

Thank you for the replies guys and galls....

Cr00zng said:

On the other hand, the FCU changes make no sense; it has limited value and will cause "knee-jerk" reactions....

Yes, a lot of people have been upset by this unannounced new 'feature' - hence the partial backtrack by Microsoft starting with the Insider build 17040. Hopefully this 'fix' (or something like it) will make its way into the next public release in April.

In the mean time, you can shut down or restart the 'traditional' way by clicking on the desktop and using the Alt+F4 menu which should eliminate the 'extra users' problem at the next boot.

Bree said:

Yes, a lot of people have been upset by this unannounced new 'feature' - hence the partial backtrack by Microsoft starting with the Insider build 17040. Hopefully this 'fix' (or something like it) will make its way into the next public release in April.

In the mean time, you can shut down or restart the 'traditional' way by clicking on the desktop and using the Alt+F4 menu which should eliminate the 'extra users' problem at the next boot.

Good advise that will work in most cases, but...

This system is imaged every night, the Alt+F4 is really not an option...