I have this showing (computername removed) is the results from logonsessions tool from sysinternals - although when I check in taskmgr for anything related to the administrator no remote (rdp) sessions nor any processes running from administrator,

can anyone offer an explanation except stealth hack???

[4] Logon session 00000000:00fcb807:
    User name:    \Administrator
    Auth package: Kerberos
    Logon type:   RemoteInteractive
    Session:      9
    Sid:          S-1-5-21-166797382-3125802628-3585296827-500
    Logon time:   6/08/2019 3:21:30 PM
    Logon server: {COMPUTERNAME}
    UPN:          Administrator@{DOMAINNAME}local

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.