Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am getting a family of computer that randomly log users off during the day. After the logoff, the user name box shows administrator no matter who was formerly logged on.

I believe it is malware but no tools have turned anything significant up that is in common with other systems experiencing the same issue.

When the user is logged off, it will keep logging them off if they attempt to log back in for about 10 - 15 minutes after which it returns to normal.

There are no other symptoms other then a bit of slowness(but the computers are fairly old) and I already checked the Userinit and Shell Reg values, they were correct. I can rule out an internal malicious user as well since their computer skill for each user is very low and I can't find any evidence in the way.

The event logs show nothing interesting either. There is also nothing in the power profile to cause this, users are logged off in the middle of typing some times.

share|improve this question

2 Answers 2

Check hibernation settings and any power profile settings which would initiate a logoff/loss of communication. (things like powering down PCI/Lan)

Do the logoffs coincide with a screensaver? - my thought is an OpenGL screensaver causing some kind of crash due to non-3D graphics cards and the machines being locked as a security measure.

share|improve this answer
1  
+1 Those open GL screen savers also run the CPU at a very high speed in some cases. –  Dave M Nov 8 '11 at 17:35
    
@HaydnWVN These settings are controlled by the GP and are all disabled. In addition, some users have been logged off while typing. –  Jeff F. Nov 8 '11 at 17:44
    
Yet there's nothing in any event logs? Additional security software installed? It sounds like the accounts are being 'locked-out' by the DC for some reason. –  HaydnWVN Nov 9 '11 at 10:02
1  
@HaydnWVN thanks for the ideas, it was actually an outside security breach. –  Jeff F. Nov 9 '11 at 20:30
up vote 2 down vote accepted

The technician who was working on this sent it up to me to look and and after I looked at it I found someone was using RDP to connect into systems from an remote system. I have no idea why RDP was allowed through the firewall. One of the passwords had been compromised as well.

share|improve this answer
    
Ouch! Quite a breach! Glad to hear you found the cause, well done! You can mark your post as the answer to close the question :) –  HaydnWVN Nov 10 '11 at 11:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.