New
#1
Differences between Logons in Event History
My monitor was waking up at random intervals.
By using a camera in the room, I recorded the times that the monitor wakes up and compared the events in Event History.
I realized that the wake up times corresponded to Logons in Windows Logs - Security Events.
There were other Logons and Special Logons which did not wake the system up, but some of these were waking the monitor up for some reason.
I did not see any difference in the Logon information that did not wake the system up, and did wake the system up.
Why are some logons waking up my system and some others are not?Code:Subject: Security ID: SYSTEM Account Name: """Computer Name""" Account Domain: """Domain Name""" Logon ID: 0x3E7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Virtual Account: No Elevated Token: Yes Impersonation Level: Impersonation New Logon: Security ID: SYSTEM Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3E7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x230 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0
How can I make sure that my system is secure and no one is seeing my monitor?
(For example, Teamviewer is installed on my computer, but it is to see other computers, not this one. This one has no random password on it, it is disabled. There is nothing in teamviewer logs, or in Event History logs).
How can I find out which process is waking up the computer?
Is there any good network monitor that can log every in/out connection to the computer?
(I tried Network Limiter, unfortunately, it does only show current connections, not the ips of past connections. I need a network monitor, that can show me the ip addresses (and machine addresses if possible) in a certain time period I specify. )
As an extra information, I checked and compared all of the logs in the Event History, and nothing matched up except some Logons.
I checked the system with Windows and third party tools, nothing found.
Only programs installed on the computer are known programs, such as TeamViewer.
I am just not able to figure out why some Logons are waking the computer up.
And I am not able to find a network monitor that can show me past connections with ip addresses.
Thanks.