Strange message at restart and shutdown...


  1. Posts : 725
    Windows 10 64-bits
       #1

    Strange message at restart and shutdown...


    I have a Windows 10 Pro 64-bit system, updated from Windows 8.1 about two weeks ego, wired connection assigned to a workgroup. The system works just fine with one exception. At the time of restart/shutdown, the system may display the following message:
    "If you shut down now, you and any other people using this PC could lose unsaved work."
    This message is more prevalent, if the restart/shutdown initiated right after login, or even prior to login, but shows up after 8-10 using the system and initiating a shutdown. My knee-jerk reaction was that the system has some malware, but had not been able to locate any. Admittedly, it does not mean the system has none...
    Actions taken so far:
    1. Scan system with Viper, Malwarebytes and Emisoft security software, came up empty
    2. Scan system off-line via Kaspersky and BitDefender, came up empty

    Disconnecting the PC from the network, for the purpose of eliminating remote connections to the PC, did not make the message go away. Evidently, this is a local logon by some process and/or scheduled task.
    The disabled UIDs are:

    • Adminstrator
    • DefaultAccount
    • Guest
    • WDAGUtilityAccount

    The enabled UIDs are:

    • UID1, standard user account
    • UID2, standard user account
    • UID3, local administarator account

    The message is coming from the file named "authui.dll":
    Windows 10 DLL File Information - authui.dll
    Reviewing the security event did not show any unknown account and the Task Scheduler shows mainly Windows scheduled tasks, with a few third-party application schedules.
    Reinstalling windows isn't really an option, one of the reasons for the update is to preserve the application and user data.
    Does anyone have an idea what triggers this message and how to get rid of it?
    TIA...
      My Computer


  2. Posts : 4,526
    Windows 11 Pro 64-bit
       #2

    From Task Manager click Users tab, make sure your user account is the only user account that is login if there are any other user accounts disconnect them by right clicking user account and select Disconnect.
      My Computer


  3. Posts : 4,224
    Windows 10
       #3

    I've noticed that even if a remote session isn't active when I log out, sometimes just having run one while I've been logged in is enough to provoke that message when I log out or restart. And for sure, an active RDP session at that time will also provoke that message.
    HTH,
    --Ed--
      My Computers


  4. Posts : 725
    Windows 10 64-bits
    Thread Starter
       #4

    Thank you for the suggestions...

    There are no other user accounts, only the "UID1, standard account" logged on to the system when checked.

    The RDP connections are disabled to this system, one of the first possible source I've looked at.

    I am not certain, if having the Windows Firewall Control on the system may have something to do with this? A number of Windows processes are blocked, for example:

    12/13/2017 12:28:12 PM | 4776 | Host Process for Windows Services | C:\windows\system32\svchost.exe | Block | Out | "local IP" | 51036 | 131.253.34.230 | 443 | 6

    12/13/2017 12:09:55 PM | 3880 | Windows Problem Reporting | C:\windows\system32\wermgr.exe | Block | Out | "local IP" | 50860 | 65.55.252.202 | 443 | 6


    12/13/2017 12:15:51 PM | 3348 | Speech Runtime Executable | C:\windows\system32\speech_onecore\common\speechruntime.exe | Block | Out | "local host IP" | 50947 | 65.55.44.108 | 443 | 6*


    *-This system doesn't have a microphone...
    And so on...

    These are no issues with not allowing connections, the system runs just fine. Other than some errors are being generated in the event viewer about the lack of connectivity....

    The Current Ports utility only shows known connections, in an other word, all connections are verified to the applications and the process path. There's no "unknown" connections...
      My Computer


  5. Posts : 24,665
    10 Home x64 (21H2) (10 Pro on 2nd pc)
       #5

    Cr00zng said:
    ...My knee-jerk reaction was that the system has some malware...
    ...Does anyone have an idea what triggers this message and how to get rid of it?
    @Cr00zng, it's probably not malware.

    The Fall Creators Update (1709) quietly introduced a new feature such that certain apps that are capable of registering for the service will be reopened at the next boot. Apparently this can sometimes have the effect that other users that were signed in at shutdown will be 'pre-signed in' at the next start up, causing the message you have seen.

    on a restart Fall Creators Update reopens apps from before

    Logout warning "Someone else is still using this pc"
      My Computers


  6. Posts : 4,224
    Windows 10
       #6

    Great explanation, Bree: nice work in connecting those dots. We who follow the forums have known about this more or less since FCU emerged, but I hadn't really stopped to think that such 'pre-signed in' services would register on par with user accounts. Makes perfect sense when you do (stop to think, that is ;-).
    Thanks again,
    --Ed--
      My Computers


  7. Posts : 24,665
    10 Home x64 (21H2) (10 Pro on 2nd pc)
       #7

    Yes, it seems that after the FCU some configurations report several users logged in after a restart, as in my second link and this one. I haven't been able to reproduce this myself, so haven't been able to diagnose further. The next release of Windows 10 (1803?) is apparently going to have a way to turn this feature off.

    Microsoft said:
    Based on your feedback, the feature to restore applications that have registered for application restart after you reboot or shutdown (through power options available on the Start Menu and various other locations) has been set to only occur for users that have enabled “Use my sign-in info to automatically finish setting my device after an update or restart” in the Privacy section under Sign-in Options Settings.
    https://blogs.windows.com/windowsexp...SEUrvYxoVKQ.97

    In the mean time, turning off 'Use my sign-in info to automatically finish setting my device after an update or restart' for each of the 'stealth' users may help.
      My Computers


  8. Posts : 725
    Windows 10 64-bits
    Thread Starter
       #8

    Bree said:
    @Cr00zng, it's probably not malware.

    After all of the testing and feedback on this forum, I am convinced that it is not malware; it is a "feature"...

    The Fall Creators Update (1709) quietly introduced a new feature such that certain apps that are capable of registering for the service will be reopened at the next boot. Apparently this can sometimes have the effect that other users that were signed in at shutdown will be 'pre-signed in' at the next start up, causing the message you have seen.

    on a restart Fall Creators Update reopens apps from before

    Logout warning "Someone else is still using this pc"

    Your statements and links make a lot of sense, thanks...

    On the other hand, the FCU changes make no sense; it has limited value and will cause "knee-jerk" reactions. At least for people, who pay attention to messages. At the very least, MS should have more descriptive message, instead of just a generic multiple user logon message. Oh well, there are more processes to block either by the firewall, or just stop starting up...

    Thank you for the replies guys and galls....
      My Computer


  9. Posts : 24,665
    10 Home x64 (21H2) (10 Pro on 2nd pc)
       #9

    Cr00zng said:
    On the other hand, the FCU changes make no sense; it has limited value and will cause "knee-jerk" reactions....
    Yes, a lot of people have been upset by this unannounced new 'feature' - hence the partial backtrack by Microsoft starting with the Insider build 17040. Hopefully this 'fix' (or something like it) will make its way into the next public release in April.

    In the mean time, you can shut down or restart the 'traditional' way by clicking on the desktop and using the Alt+F4 menu which should eliminate the 'extra users' problem at the next boot.
      My Computers


  10. Posts : 725
    Windows 10 64-bits
    Thread Starter
       #10

    Bree said:
    Yes, a lot of people have been upset by this unannounced new 'feature' - hence the partial backtrack by Microsoft starting with the Insider build 17040. Hopefully this 'fix' (or something like it) will make its way into the next public release in April.

    In the mean time, you can shut down or restart the 'traditional' way by clicking on the desktop and using the Alt+F4 menu which should eliminate the 'extra users' problem at the next boot.
    Good advise that will work in most cases, but...

    This system is imaged every night, the Alt+F4 is really not an option...
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 19:21.
Find Us




Windows 10 Forums