1

I am getting a family of computer that randomly log users off during the day. After the logoff, the user name box shows administrator no matter who was formerly logged on.

I believe it is malware but no tools have turned anything significant up that is in common with other systems experiencing the same issue.

When the user is logged off, it will keep logging them off if they attempt to log back in for about 10 - 15 minutes after which it returns to normal.

There are no other symptoms other then a bit of slowness(but the computers are fairly old) and I already checked the Userinit and Shell Reg values, they were correct. I can rule out an internal malicious user as well since their computer skill for each user is very low and I can't find any evidence in the way.

The event logs show nothing interesting either. There is also nothing in the power profile to cause this, users are logged off in the middle of typing some times.

2 Answers 2

2

The technician who was working on this sent it up to me to look and and after I looked at it I found someone was using RDP to connect into systems from an remote system. I have no idea why RDP was allowed through the firewall. One of the passwords had been compromised as well.

1
  • Ouch! Quite a breach! Glad to hear you found the cause, well done! You can mark your post as the answer to close the question :)
    – HaydnWVN
    Nov 10, 2011 at 11:50
1

Check hibernation settings and any power profile settings which would initiate a logoff/loss of communication. (things like powering down PCI/Lan)

Do the logoffs coincide with a screensaver? - my thought is an OpenGL screensaver causing some kind of crash due to non-3D graphics cards and the machines being locked as a security measure.

4
  • 1
    +1 Those open GL screen savers also run the CPU at a very high speed in some cases.
    – Dave M
    Nov 8, 2011 at 17:35
  • @HaydnWVN These settings are controlled by the GP and are all disabled. In addition, some users have been logged off while typing.
    – Jeff F.
    Nov 8, 2011 at 17:44
  • Yet there's nothing in any event logs? Additional security software installed? It sounds like the accounts are being 'locked-out' by the DC for some reason.
    – HaydnWVN
    Nov 9, 2011 at 10:02
  • 1
    @HaydnWVN thanks for the ideas, it was actually an outside security breach.
    – Jeff F.
    Nov 9, 2011 at 20:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .