Logout warning "Someone else is still using this pc"

Since the recent Windows 10 update (about October 26) I have been receiving the following error when I log out, even when quickly logging out after a restart or power up start.

•Someone else is still using this pc. If you restart now, they could lose unsaved work.

Does anyone know how to investigate and or explain what might be happening?

I THINK it is due to the new account "WDAGUtilityAccount" (I did not Enroll to the insider program) that was created. While it says it is Disabled it may actually be being used which would account for this issue which started when the account was created. Then again, I could just be paranoid.

Additional facts:
I am using WiFi. The router is configured to require the SSID of any connecting device for anyone to connect. No computer is configured to allow access by another device.
While I have never checked before, Task Manager often shows periods of usage (CPU 0.1% to 0.7%) on the account that is not logged in. Task Manger only lists Expert & Novice but never Exper which, I believe, is the For1Drive account (A Microsoft User account).

Here are the accounts listed on this system (User #s removed for brevity)
MS Default accounts
• Administrator (...-500 - Administrator - Disabled)
• Guest (...-501 - Limited - Disabled)
• DefaultAccount (...-503 - Limited - Disabled)
WDAGUtilityAccount (...-504 - Limited - Disabled) Created for those who enrolled in the Windows 10 insider program. This account is part of "Windows Defender Application Guard" and began with the windows 10 fall update release. I DID NOT ENROLL!
Expert (...-1001 - Administrator - Enabled) => C:\Users\Expert The Local Admin account
Novice (...-1002 - Limited - Enabled) => C:\Users\Novice The Local User account
Exper (...-1003 - Limited - Enabled) => C:\Users\Exper The Microsoft User account. In Manage Users it is listed as For1Drive and, by logging into it, OneDrive can be used without always being logged into Microsoft. I don't remember why it was named Exper....


OS: Windows 10 Pro 64bit
ASUS ROG G751JY (Laptop)
CPU: 2.50 gigahertz Intel Core i7-4710HQ
MB: ASUSTeK COMPUTER INC. G751JT 1.0
Mem: 32 MB
Graphics card: NVIDIA GeForce GTX 970M

Interesting... an email was received stating

<UID withheld> has just replied to a thread you have subscribed to entitled - Logout warning "Someone else is still using this pc".

Clicked on the link and found nothing.

Yes, you are the culprit! Glad to know what happened.

That is a possibility but I have never received these messages until the latest Windows update, for me, October 27. Well, I have received them those rare times I switched users and then forgot. At first, it only happened on the admin account but has "spread" to the user account.

ExpertNovice said:

I THINK it is due to the new account "WDAGUtilityAccount" (I did not Enroll to the insider program) that was created... Then again, I could just be paranoid.

I don't think so, we all have that account (set as disabled) since the Fall Creators Update. You're the first I've seen to report this symptom (I don't have it).

username: WDAGUtilityAccount ... This account is part of Windows Defender Application Guard which is included with RS3 (aka windows 10 fall update). The account is disabled also WDAG is not enabled.

https://blogs.technet.microsoft.com/...tilityaccount/

Windows Defender Application Guard is only used in an Enterprise environment (maybe by Insiders too).

... Task Manager often shows periods of usage (CPU 0.1% to 0.7%) on the account that is not logged in. Task Manger only lists Expert & Novice but never Exper which, I believe, is the For1Drive account (A Microsoft User account).
... I don't remember why it was named Exper....

MS accounts take as their name the first 5 characters on the user who created it - usually the first 5 from the email address they used.

Interesting that Task Manager shows the two local user accounts, Expert & Novice. There's a new feature in 1709 which may have a bearing on this. When you shut down or restart from the Start menu, any program that is capable of being restarted will restart the next time you boot up the PC. Apps that will restart include MS Office, Task Manager, Internet Explorer and Wordpad. Apps that can't restart include the Settings app, Edge, Notepad and (as far as we know) all modern windows apps. Some third party apps can restart too, Chrome does, Firefox doesn't.
on a restart Fall Creators Update reopens apps from before

This is not actually a new behaviour, it has been available from the command line for some time in the shutdown command. What is new in 1709 is that the power button on Start now uses the 'g' form of the command.

Code:

Usage: shutdown [/i | /l | /s | /sg | /r | /g | /a | /p | /h | /e | /o] [/hybrid] [/soft] [/fw] [/f]
    [/m \\computer][/t xxx][/d [p|u:]xx:yy [/c "comment"]]
.....
    /s         Shutdown the computer.
    /sg        Shutdown the computer. On the next boot,
               restart any registered applications.
    /r         Full shutdown and restart the computer.
    /g         Full shutdown and restart the computer. After the system is
               rebooted, restart any registered applications.

Where this may be of relevance is that that this applies to ALL users that were logged in at the time the PC was shut down, not just the one that you were in when you shut down the PC. Processes that the other users had open will be restarted.

To test if this is the cause of your problem, try shutting down or restarting the 'old way'. There is no option for this on Start's power button, so use another method. A proper shutdown with nothing restarting can be done from the command line with shutdown /s or click on an empty part of the Desktop then use Alt-F4.

Shut Down Computer in Windows 10 Performance Maintenance Tutorials

If my suspicions are correct, next time you boot your PC you'll be able to shut down without 'other users' getting in your way.

Wow, thanks. I will try this tomorrow. Today has been helping others and that won't end for a few hours more. Currently, only the User account is listed. All I can say is if I had much hair I would have no hair left after this week!

Again, thank you so much for your time as well as the information.

If I log out using the shutdown or restart options in the Start menu and then log into the other account both users show up in Task Manager.

If I log out using Alt-F4 and shutdown (I didn't try restart) and then log into the other account only the current user shows up in Task Manager.

As long as only the current user is listed in Task Manager no warning is given when logging out.

The thread explains quite a bit. Given the above tests it seems this is a bug that effects some systems. I say bug becuase it doesn't appear to be an app restarting.

This also PROVES it is not the WDAG being invisibly active. One sentence you left out from the Blog is, "Basically you have user enrolled in the Windows 10 insider program and their box was updated with a new build that includes the WDAG bits". Yet, I am the only user and I did not enroll in the insiders program and this is not a Enterprise OS or environment.

I can see why you have a label of Guru! Thank you so much.

ExpertNovice said:

Given the above tests it seems this is a bug that effects some systems. I say bug becuase it doesn't appear to be an app restarting...

You may well be right. I've tried to reproduce the effect by having two accounts signed in with various apps running in the other user account then using Start menu to shut down. While Task Manager shows the presence of the other user's processes, I can't get both users to show on its 'Users' tab.

Well, that is interesting. I have not tried starting an app and then switching users. I will try that this evening.

Typically, you see the other user's App as a process, but not in the list of Apps. Notepad in this example won't restart if you shut down and restart 1709, but Wordpad and Task Manager do.