User automatically logged in on power on Windows 11

Question

Hello,

I had powered my windows 11 Pro PC off overnight, and my son (who really doesn't know my password) turned it on at 6:21:19 today. When I went to log in later at 7:19, I noticed my account was already logged in. Naturally I went to the event viewer and noticed that at 6:21:01 there was a login by my account in the event log, followed by a special login asking for a bunch of privileges. I did notice the impersonation level was set in the logon entry.

Can anyone help me explain what happened? I want to make sure this is benign and not some malware. Please and thank you!

Answer 1

Hello Mega-Gazz,

Thank you for your question and for reaching out with your question today.

Based on the information you provided, it seems unusual that your account was logged in without your knowledge or presence. While it's difficult to determine the exact cause without more detailed information, there are a few possibilities to consider:

1. Automatic login: Windows has a feature called "Automatic login" that allows a user account to log in automatically without entering a password. It's possible that this feature was enabled on your computer, and your son inadvertently triggered the automatic login process when turning on the PC.
2. Cached credentials: Windows caches user credentials to allow for offline login in certain scenarios. If you had previously logged in to your account on the same PC, it's possible that your credentials were cached, and Windows used them to log you in automatically.
3. Remote access software: If you have remote access software installed on your PC, it's possible that someone accessed your computer remotely. However, this would typically require the user to have your password or use other authentication methods.
4. Malware or unauthorized access: While it's not possible to definitively rule out the presence of malware or unauthorized access without further investigation, it's less likely considering the limited information provided. However, it's always a good idea to regularly scan your system with reputable antivirus or anti-malware software to ensure it remains secure.

To further investigate the situation and ensure your system's security, consider the following steps:

1. Change your password: As a precautionary measure, change your account password to ensure that only you have access to your account.
2. Review installed applications: Check your computer for any installed applications or remote access software that you don't recognize. Remove any suspicious or unknown applications.
3. Perform a malware scan: Use a reputable antivirus or anti-malware software to perform a thorough scan of your system. Ensure that your antivirus definitions are up to date.
4. Check for unauthorized remote access: Review your PC's remote access settings and disable any remote access features or software that you don't require or recognize.

If you notice any further suspicious activities or have ongoing concerns, it's advisable to consult with a cybersecurity professional who can perform a more in-depth analysis of your system's security.

I used AI provided by ChatGPT to formulate part of this response. I have verified that the information is accurate before sharing it with you.

If the reply was helpful, please don’t forget to upvote or accept as answer.

Best regards.

Answer 2

I'm experiencing the same issue.

I think it's probably this:

https://answers.microsoft.com/en-us/windows/forum/all/background-automatic-login-of-other-accounts/92628d17-2763-42d3-bb57-060663f616d3