UserLogoff without a UserLogon

Question

Was reviewing some logs to see who was on a system at a specific time and found 3 different users with a UserLogoff; however, there is no corresponding UserLogon.  The specific system in question is a non-domain system (local accounts only) and the LogonType for the UserLogoff events was "Windows: Remote Interactive Logon".

Any ideas on what would cause this or how it's possible?

FormerMember · Answer

One possibility - the logon used cached credentials. Look for "Cached Interactive Logon" in addition to "Remote Interactive Logon".

Sohail.Bhamani · Answer

That sure is strange.  I do not have access to my LEM console from my current client, but I do remember the RDP logon type being different from one where a person logs in to a machine directly (ie, not rdp and on the local console).  So it is strange, but I think you are just not seeing the logon message as its not being reported exactly how a console type logon is in LEM.  What you are seeing is the RDP session being closed I feel.

Sohail Bhamani

Loop1 Systems

http://www.loop1systems.com