0

I know for certain that I was away from my Windows 7 Home Premium laptop between 12:35 and 14:37. But the eventvwr.exe shows the following:

  • 28/10/2015 14:54:25 Event ID 4624 (access type: 2)
  • 28/10/2015 14:36:44 Event ID 4624 (access type: 7)
  • 28/10/2015 13:08:52 Event ID 4624 (access type: 5)
  • 28/10/2015 12:19:01 Event ID 4624 (access type: 5)
  • 28/10/2015 12:17:59 Event ID 4624 (access type: 2)

It seems like someone (who has the key to my living place) logged in at 13:08:52 when I was away.

How is this possible?

I am absolutely certain that nobody knows my password. It is unique and I don't use it anywhere else.

Is there a way Event ID 4624 could correspond to something other than a physical person logging in, or is there some way someone could enter by brute force that I am not aware of? Thanks.

EDIT: Here are the details pertaining to the access at 13:08:52 (once again, sorry if the log is in Italian, I am running a localized version of Windows):

Accesso di un account riuscito.

Soggetto:
    ID sicurezza:       SYSTEM
    Nome account:       NEIL-PC$
    Dominio account:        WORKGROUP
    ID accesso:     0x3e7

Tipo di accesso:            5

Nuovo accesso:
    ID sicurezza:       SYSTEM
    Nome account:       SYSTEM
    Dominio account:        NT AUTHORITY
    ID accesso:     0x3e7
    GUID accesso:       {00000000-0000-0000-0000-000000000000}

Informazioni sul processo:
    ID processo:        0x2a0
    Nome processo:      C:\Windows\System32\services.exe

Informazioni di rete:
    Nome workstation:   
    Indirizzo rete di origine:  -
    Porta di origine:       -

Informazioni di autenticazione dettagliate:
    Processo di accesso:        Advapi  
    Pacchetto di autenticazione:    Negotiate
    Servizi transitati: -
    Nome pacchetto (solo NTLM): -
    Lunghezza chiave:       0

Questo evento viene generato quando viene creata una sessione di accesso. Viene generato nel computer in cui è stato effettuato l'accesso.

Il campo Soggetto indica l'account nel sistema locale che ha richiesto l'accesso. Generalmente si tratta di un servizio, quale il servizio Server, o di un processo locale, ad esempio Winlogon.exe o Services.exe.

Il campo Tipo di accesso indica il tipo di accesso che è stato effettuato. I tipi più comuni sono 2 (interattivo) e 3 (rete).

Il campo Nuovo accesso indica l'account per il quale è stato creato il nuovo accesso, vale a dire l'account che ha effettuato l'accesso.

Il campo Informazioni di rete indica l'origine della richiesta di accesso remota. Il nome della workstation non è sempre disponibile e può essere vuoto in alcuni casi.

Il campo Informazioni di autenticazione fornisce informazioni dettagliate sulla specifica richiesta di accesso.
    - GUID accesso è un identificatore univoco che può essere utilizzato per correlare questo evento a un evento KDC.
    - Servizi transitati indica quali servizi intermedi hanno partecipato alla richiesta di accesso.
    - Nome pacchetto indica quale sottoprotocollo dei protocolli NTLM è stato utilizzato.
    - Lunghezza chiave indica la lunghezza della chiave di sessione generata. Se non è stata richiesta alcuna chiave di sessione, la lunghezza sarà pari a zero.
Improve this question
4
  • 3
    Why not look at the detail of the event and see what account was logging in? Could have been a system account.
    – Paul
    Commented Oct 28, 2015 at 21:02
  • I've updated my post. Could you make out the kind of access?
    – Jordan Jamingsons
    Commented Oct 28, 2015 at 21:10
  • @Paul, could you please help me... the access type is set to 5, and the message says the most common access types are 2 for interactive, and 3 for a network access. Any ideas what 5 stands for?
    – Jordan Jamingsons
    Commented Oct 28, 2015 at 21:12
  • 1
    Logon Type 5 - Service, from windowsecurity.com/articles-tutorials/misc_network_security/…. So just system services doing their thing.
    – jjlin
    Commented Oct 28, 2015 at 21:31

2 Answers 2

Reset to default
5

SYSTEM Nome account: SYSTEM

I dont speak italian but this looks like a system action...

Improve this answer
5
  • Thanks. The problem I am having is that my version of windows doesn't log unlock and lock events, which leaves a shade of doubt. Could you please help me find some other things to look for as evidence on this version of Windows 7 of an intrusion? It's very important to me.
    – Jordan Jamingsons
    Commented Oct 28, 2015 at 21:19
  • 1
    @JordanJamingsons Your copy of Windows DOES log Unlocks, that's what Logon/Access Type 7 is (i.e.: 28/10/2015 14:36:44 Event ID 4624 (access type: 7)).
    – Ƭᴇcʜιᴇ007
    Commented Oct 28, 2015 at 21:34
  • Thanks, now that's a great comment. Now what I need is to find a screen lock event. If the screen did not lock within the amount of time set in the control panel I will know someone accessed my computer. I would really really really appreciate help with this...
    – Jordan Jamingsons
    Commented Oct 28, 2015 at 21:45
  • @Ƭᴇcʜιᴇ007, I don't get it. You say that access type 7 is a screen unlock, whereas the answer to this post says event locks and unlocks cannot be logged in Home Premium. What is the truth?
    – Jordan Jamingsons
    Commented Oct 28, 2015 at 21:49
  • There's a difference between logging the Locks and Unlocks, and Logging in successfully after unlocking. The latter is what you have, the former is what you need Pro for.
    – Ƭᴇcʜιᴇ007
    Commented Oct 28, 2015 at 21:52
2

Nome processo: C:\Windows\System32\services.exe

This says the process name that requested the logon was Services.exe, which is the file used by Windows to control system services.

Nome account: SYSTEM

The name of the account that ran Services.exe is SYSTEM, which is the system account (Windows itself).

Tipo di accesso: 5

Type of Access/Logon Type: 5 means "Service".

Here's a complete list of logon types

So it was Windows starting a service, and that service is set to login as the System account.

This is all perfectly normal.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .