How and what exactly do I look for remote access programs or similar?

“Your IT Administrator Has Limited Access” Windows Security Error < - most likely due to Malwarebytes
 
Malwarebytes has the capability to register in Windows Security, allowing users to configure Malwarebytes as their primary security solution or to run alongside their third party antivirus application. By default, Malwarebytes automatically decides whether or not to register itself with Windows Security Center settings as noted here (by exile360) in order for Windows to recognize it as security software. This means Windows Defender's real-time protection will be turned off. You can override this behavior in Malwarebytes > Settings > Security tab > Windows Security Center and choose to "Never register Malwarebytes in the Windows Action Centre"...by leaving that option unchecked.

• Register Malwarebytes with Windows Security Center

You said "it simply turned itself back on", does that mean Microsoft Defender is working again?

I tried malwarebytes, but it sent me a notification saying my Defender was disabled. When I went there to turn it back on, it simply turned itself back on and said my IT Administrator has limited core access.

I don't know whether this is normal, my account is an administrator account itself...what even is IT Administrator in this case? In the event viewer it says I have enumerated credentials.

Local Accounts are defined locally on a device and can be assigned rights and permissions on the device only
Default local user accounts are built-in accounts that are created automatically when the operating system is installed and cannot be removed or deleted.

Default local system accounts include:

• SYSTEM account is used by the operating system and by services running under Windows to perform tasks that require local system permissions.
• NETWORK SERVICE account is a predefined local account used by the service control manager (SCM).
• LOCAL SERVICE account is a predefined local account with minimum privileges on the local computer and used by the service control manager...it presents anonymous credentials on the network.

The term "impersonation" does not necessarily mean that your system is compromised. In Windows Security, WindowsIdentity.Impersonate Method is a feature that allows code to impersonate a different Windows user. More specifically it allows a service to use a client's identity to perform an action on behalf of a client. The server process can impersonate the client's security context on its local system. Event viewer can show the WindowsIdentity.ImpersonationLevel (WindowsIdentity class) for the current user.

System Account names like DWM-1, DWM-2, UMFD-0, UMFD-3 can appear for system-initiated logons such as Desktop Window Manager and/or User Mode Font Driver processes.

Did you run any of the scans I suggested?

For the event viewer, I have checked and see the following results:

• Most of special logons are from SYSTEM and DWM-4 with the Security ID being S-1-X and then numbers..but the DWM-4's last two Logon ID digits always randomize.
• Some logoffs show SYSTEM, my desktop username, and DWM-3 and UMFD-3, with all of their last two Logon ID digits randomized except for the SYSTEM one.
• When looking at my own logons recently, there are two of them: one without elevated token and one with an elevated token. Their Logon ID's are also randomized but not constantly (by this I mean it would just be the same ID's on every other logon list)

There is something that says "Impersonation Level: Impersonation" specifically on the account with my desktop's username.

• There are special logons by the Administrator account, which is the one I use for this computer and the LogonID completely randomizes every logon.

For Remote Access, no connections are allowed on this computer.