I left a python script running all night. And in the morning I noticed that my computer was with the login screen, waiting for me to type the password (interactive mode). I did not expected that, the program stopped, and upon login, it was as if the PC restarted.
By checking the windows event logs. I noticed that at 4:07 am (obviously, no one was around my pc) i got a 1100 EventLog, which probably indicates a shutoff (No one requested it). After that event, I got hundreds of 4907 events (audit policy change) all at 4:07:22 am , all with security ID System, and each altering a different file "C:\Windows\SysWOW64" , at 4:08 Am I got several process creations (mainly teams, skype, and those things), and In the next 3 minutes, more than 30 logons were made (events 4624). My PC is not a server, it is just my own PC, but it was connected to wifi though. Out of those 30 logons, i noticed that the very first one had a logon type 0! I searched for this type of logon type and couldn't find other documentation other that types 1-9. Anyway, on that first 0 type logon, the security ID was NULL SID, and the logon id was 0x0, with a GUID full of 0s
Then, after that first type 0 logon, all the other logons are type 5 (most of them) with the same user (my PC has only 1 user), but some of them (more than 1) were type 2, which I understand is interactive mode. But no one was around my PC at 4 am. Some logons type 5 were followed by special logons (event 4672) with user name SYSTEM.
After those 30 logons in the 3 minutes span, all other security events were logons and special logons from 4:20 am to 9:20 am. I tried to match the logoffs attempts, but I only found 2 around 9:20 am when I was just about to use my PC to find the login screen.
Can someone help me to understand what this means, what happened, and what a logon type 0 is?
