Windows 10: Strange message at restart and shutdown... Solved

  1.    13 Dec 2017 #1

    Strange message at restart and shutdown...


    I have a Windows 10 Pro 64-bit system, updated from Windows 8.1 about two weeks ego, wired connection assigned to a workgroup. The system works just fine with one exception. At the time of restart/shutdown, the system may display the following message:
    "If you shut down now, you and any other people using this PC could lose unsaved work."
    This message is more prevalent, if the restart/shutdown initiated right after login, or even prior to login, but shows up after 8-10 using the system and initiating a shutdown. My knee-jerk reaction was that the system has some malware, but had not been able to locate any. Admittedly, it does not mean the system has none...
    Actions taken so far:
    1. Scan system with Viper, Malwarebytes and Emisoft security software, came up empty
    2. Scan system off-line via Kaspersky and BitDefender, came up empty

    Disconnecting the PC from the network, for the purpose of eliminating remote connections to the PC, did not make the message go away. Evidently, this is a local logon by some process and/or scheduled task.
    The disabled UIDs are:

    • Adminstrator
    • DefaultAccount
    • Guest
    • WDAGUtilityAccount

    The enabled UIDs are:

    • UID1, standard user account
    • UID2, standard user account
    • UID3, local administarator account

    The message is coming from the file named "authui.dll":
    Windows 10 DLL File Information - authui.dll
    Reviewing the security event did not show any unknown account and the Task Scheduler shows mainly Windows scheduled tasks, with a few third-party application schedules.
    Reinstalling windows isn't really an option, one of the reasons for the update is to preserve the application and user data.
    Does anyone have an idea what triggers this message and how to get rid of it?
    TIA...
      My ComputerSystem Spec

  2.    13 Dec 2017 #2

    From Task Manager click Users tab, make sure your user account is the only user account that is login if there are any other user accounts disconnect them by right clicking user account and select Disconnect.
      My ComputerSystem Spec

  3.    13 Dec 2017 #3

    I've noticed that even if a remote session isn't active when I log out, sometimes just having run one while I've been logged in is enough to provoke that message when I log out or restart. And for sure, an active RDP session at that time will also provoke that message.
    HTH,
    --Ed--
      My ComputersSystem Spec

  4.    13 Dec 2017 #4

    Thank you for the suggestions...

    There are no other user accounts, only the "UID1, standard account" logged on to the system when checked.

    The RDP connections are disabled to this system, one of the first possible source I've looked at.

    I am not certain, if having the Windows Firewall Control on the system may have something to do with this? A number of Windows processes are blocked, for example:

    12/13/2017 12:28:12 PM | 4776 | Host Process for Windows Services | C:\windows\system32\svchost.exe | Block | Out | "local IP" | 51036 | 131.253.34.230 | 443 | 6

    12/13/2017 12:09:55 PM | 3880 | Windows Problem Reporting | C:\windows\system32\wermgr.exe | Block | Out | "local IP" | 50860 | 65.55.252.202 | 443 | 6


    12/13/2017 12:15:51 PM | 3348 | Speech Runtime Executable | C:\windows\system32\speech_onecore\common\speechruntime.exe | Block | Out | "local host IP" | 50947 | 65.55.44.108 | 443 | 6*


    *-This system doesn't have a microphone...
    And so on...

    These are no issues with not allowing connections, the system runs just fine. Other than some errors are being generated in the event viewer about the lack of connectivity....

    The Current Ports utility only shows known connections, in an other word, all connections are verified to the applications and the process path. There's no "unknown" connections...
      My ComputerSystem Spec


  5. Posts : 5,394
    10 Home x64 (1709) (10 Pro on 2nd pc)
       13 Dec 2017 #5

    Cr00zng said: View Post
    ...My knee-jerk reaction was that the system has some malware...
    ...Does anyone have an idea what triggers this message and how to get rid of it?
    @Cr00zng, it's probably not malware.

    The Fall Creators Update (1709) quietly introduced a new feature such that certain apps that are capable of registering for the service will be reopened at the next boot. Apparently this can sometimes have the effect that other users that were signed in at shutdown will be 'pre-signed in' at the next start up, causing the message you have seen.

    on a restart Fall Creators Update reopens apps from before

    Logout warning "Someone else is still using this pc"
      My ComputersSystem Spec

  6.    13 Dec 2017 #6

    Great explanation, Bree: nice work in connecting those dots. We who follow the forums have known about this more or less since FCU emerged, but I hadn't really stopped to think that such 'pre-signed in' services would register on par with user accounts. Makes perfect sense when you do (stop to think, that is ;-).
    Thanks again,
    --Ed--
      My ComputersSystem Spec


  7. Posts : 5,394
    10 Home x64 (1709) (10 Pro on 2nd pc)
       13 Dec 2017 #7

    Yes, it seems that after the FCU some configurations report several users logged in after a restart, as in my second link and this one. I haven't been able to reproduce this myself, so haven't been able to diagnose further. The next release of Windows 10 (1803?) is apparently going to have a way to turn this feature off.

    Microsoft said:
    Based on your feedback, the feature to restore applications that have registered for application restart after you reboot or shutdown (through power options available on the Start Menu and various other locations) has been set to only occur for users that have enabled “Use my sign-in info to automatically finish setting my device after an update or restart” in the Privacy section under Sign-in Options Settings.
    https://blogs.windows.com/windowsexp...SEUrvYxoVKQ.97

    In the mean time, turning off 'Use my sign-in info to automatically finish setting my device after an update or restart' for each of the 'stealth' users may help.
      My ComputersSystem Spec

  8.    13 Dec 2017 #8

    Bree said: View Post
    @Cr00zng, it's probably not malware.

    After all of the testing and feedback on this forum, I am convinced that it is not malware; it is a "feature"...

    The Fall Creators Update (1709) quietly introduced a new feature such that certain apps that are capable of registering for the service will be reopened at the next boot. Apparently this can sometimes have the effect that other users that were signed in at shutdown will be 'pre-signed in' at the next start up, causing the message you have seen.

    on a restart Fall Creators Update reopens apps from before

    Logout warning "Someone else is still using this pc"

    Your statements and links make a lot of sense, thanks...

    On the other hand, the FCU changes make no sense; it has limited value and will cause "knee-jerk" reactions. At least for people, who pay attention to messages. At the very least, MS should have more descriptive message, instead of just a generic multiple user logon message. Oh well, there are more processes to block either by the firewall, or just stop starting up...

    Thank you for the replies guys and galls....
      My ComputerSystem Spec


  9. Posts : 5,394
    10 Home x64 (1709) (10 Pro on 2nd pc)
       13 Dec 2017 #9

    Cr00zng said: View Post
    On the other hand, the FCU changes make no sense; it has limited value and will cause "knee-jerk" reactions....
    Yes, a lot of people have been upset by this unannounced new 'feature' - hence the partial backtrack by Microsoft starting with the Insider build 17040. Hopefully this 'fix' (or something like it) will make its way into the next public release in April.

    In the mean time, you can shut down or restart the 'traditional' way by clicking on the desktop and using the Alt+F4 menu which should eliminate the 'extra users' problem at the next boot.
      My ComputersSystem Spec

  10.    13 Dec 2017 #10

    Bree said: View Post
    Yes, a lot of people have been upset by this unannounced new 'feature' - hence the partial backtrack by Microsoft starting with the Insider build 17040. Hopefully this 'fix' (or something like it) will make its way into the next public release in April.

    In the mean time, you can shut down or restart the 'traditional' way by clicking on the desktop and using the Alt+F4 menu which should eliminate the 'extra users' problem at the next boot.
    Good advise that will work in most cases, but...

    This system is imaged every night, the Alt+F4 is really not an option...
      My ComputerSystem Spec


 

Related Threads
Strange Behavior of Shutdown in General Support
Just recently I've been experiencing strange behavior whenever I shutdown. These events happen seemingly randomly: 1. It says Shutting Down, the progress circle is moving, but it never shuts down and the Shutting Down screen stays that way for...
Strange Message at Boot Up in PC Custom Builds and Overclocking
3 days ago I had built my PC. I tested it out by just installing the CPU, PSU and ram only. When I was done, I booted it up and I saw the MSI splash screen (since its an MSI mobo) and then the boot menu, which indicated everything was ok. Today,...
restart shutdown in Windows Updates and Activation
hello, Im just having one problem with win 10 The restart shuts down my computer and I don't have this problem on linux mint can someone point me to a solution. I have tried to turn off hibernation and it seemed to be working for a little while...
Shutdown slow and strange in General Support
Just upgraded (via Windows Update) from Win 7 Pro to Windows 10. Upgrade generally went smoothly, but.... My PC now shuts down very slowly and oddly. The screen and keyboard turn off normally, in a few seconds, but the system box (fans, etc.)...
I Just got a new notification popup that said "Windows 10 Team Profile Graylynne M. R?" I'm not sure of what the rest say'. I'm not sure if I should click on it or not. Anyone know what this is about? :confused:
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 15:04.
Find Us