This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(182.40000000000003, 87%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPM%3C/text%3E%3C/svg%3E)
Hi we have a Windows Server 2019 with Active Directory. I am working on a new laptop. Until now in the C:\User folder was only my name, Default and another name. But suddenly since Tuesday another username shows up in the C:\User folder. Does this mean this person logged on to my laptop manually or can a profile name be created in C:\User even if that person did something remotely over Powershell. Just FYI Remote Desktop Connection is turned off on my laptop.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Can a user folder be created in the C:\User folder if they were doing some updates over the network?
I suppose anything is possible. Do you see ntuser.dat? If so then someone logged on and the file timestamp should tell you when they last logged on.
--please don't forget to upvote and Accept as answer if the reply is helpful--
Yes, there is a ntuser.dat and the date of modification is 25.10.2022 (Tuesday). Does that mean when I was not in my office they came in and logged into my laptop with their username?
Sure looks that way.
--please don't forget to upvote and Accept as answer if the reply is helpful--
Just a reminder, please don't forget to close up the thread by 
Just checking if there's any progress or updates?
--please don't forget to upvote and Accept as answer if the reply is helpful--
Not yet, I just want to be certain before I ask this co-worker anything or take this any further. We have a strict rule at work to not look into anyone's computer without first confirming that with them so I need to get to the bottom of this.
Just a reminder, please don't forget to close up the thread by
Just checking if there's any progress or updates?
--please don't forget to upvote and Accept as answer if the reply is helpful--
Not much to go on but most likely is the user has logged on to the laptop locally or remotely.
--please don't forget to upvote and Accept as answer if the reply is helpful--
Remote Desktop Connection is turned off. Then can they remotely login to the PC? If so, how? Can a user folder be created in the C:\User folder if they were doing some updates over the network?
If you need any further information please ask, I just don't know what information I should provide?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(76.8, 88%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EZC%3C/text%3E%3C/svg%3E)
There are other ways a user can log into your machine, a few examples are psexec or remote PowerShell. However, they would most likely need to be local administrator to do this.
I would look at the Windows Security Event Logs to see if there's any clues to what might have happened.
A few questions might help also.
Is the computer added to a domain? Is the new profile a domain user? If it's not added to a domain then is the user a local admin on the computer? You can check this using computer management.
Yes, the computer is in a domain and the new profile is a domain user. In the event log there was a logon, special logon and logoff from this user. But there has been logon, special logon and logoff events from that user even 2 days ago, but the ntuser.dat timestamp hasn't changed from the day when the suspicious event occurred. I also checked on other PCs in the domain, when these logon logoffs happened on their PCs but this user wasn't on the PC in person the date on the ntuser.dat didn't change. Do you think the ntuser.dat can be affected if the person was just doing updates in the background using PowerShell? I would also like to point out that Remote Desktop Connection is turned off.
It's possible to remote PowerShell into a computer where Remote Desktop connection is disabled. It could also be a scheduled task if it happens at the same time every day.
It could be your IT performing application updates on the laptop, depending on the tool it might leave a profile behind.
Does it have a predictable pattern? There are some things you can do to log the network connections to your laptop so you might be able to find out where it's coming from. The most obvious choice that comes to mind is ProcMon: https://learn.microsoft.com/en-us/sysinternals/downloads/procmon
In summary - this is one of those things that you'll need to dig a bit deeper with.
Hi, I looked into the event manager and it is not a scheduled event. This was a one off incident. There are other log on and log off on some other dates, however, the profile didn't update and the date on the ntuser.dat didn't change on those occasions. What would this imply? Can you infer whether the action could be intentional and malicious or do you think no malicious intents were behind this attempt?