Event ID 4624 with logon type 11 and my Security ID / Account Name when I wasn't there?

Question

Hello, logon events when you're not present usually have some windows process as the Security ID and Account Name. Yet I saw logons when not using my laptop with the same Security ID and Account Name as when I actually logon myself. Some of the data is included below

An account was successfully logged on.  Subject:     Security ID:        SYSTEM     Account Name:       NAME$     Account Domain:     WORKGROUP     Logon ID:       0x3E7  Logon Information:     Logon Type:     11     Restricted Admin Mode:  -     Remote Credential Guard:    -     Virtual Account:        No     Elevated Token:     Yes  Impersonation Level:        Impersonation  New Logon:     Security ID:        NAME\awe     Account Name:       my email address     Account Domain:     MicrosoftAccount  Process Information:     Process ID:     0xa20     Process Name:       C:\Windows\System32\svchost.exe 

However in the same time stamp there were also logons from

Security ID:        Window Manager\DWM-1
    Account Name:       DWM-1
    Account Domain:     Window Manager

and

Security ID:        Font Driver Host\UMFD-1
    Account Name:       UMFD-1
    Account Domain:     Font Driver Host

So is it normal to see logons from your own security id and account name after those Microsoft processes logon? Thanks for the help.

Answer 1

Hello Loopy55, welcome to Microsoft Q&A forum.

The AI answer is correct. I'll just add a bit more context on when you typically see these events:

These Logon Type 11 events with DWM-1 and UMFD-1 usually appear during:

• Waking from sleep or hibernation
• Fast Startup (hybrid boot sequence)
• Background session reconnection when graphics/font subsystems reinitialize

So if you see them when you weren't actively using the laptop, that's why — Windows is resuming your session in the background or maintaining the desktop environment.

For the official reference on Event ID 4624 and all logon types, see: https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624

You're all good — no security concern here.

Answer 2

Yes, this pattern is normal and does not by itself indicate that someone else logged on interactively.

From the event snippet:

• Subject → Security ID: SYSTEM / Account Name: NAME$
  • This indicates the local system (the OS itself, via the computer account) requested the logon.
• Logon Type: 11
  • Logon type 11 is a special logon (e.g., used for cached credentials, service operations, or background tasks) rather than a normal interactive sign-in at the keyboard.
• New Logon → Security ID: NAME\awe / Account Name: your email / Account Domain: MicrosoftAccount
  • This shows Windows is creating a new logon session using the same Microsoft account that is used for the normal sign-in, but initiated by SYSTEM, not by a user typing credentials.
• Process Name: C:\Windows\System32\svchost.exe
  • svchost.exe hosts many Windows services; it is common for services to create additional logon sessions under the user’s identity for background operations.

At the same timestamp, there are also logons for:

• Window Manager\DWM-1 (Desktop Window Manager)
• Font Driver Host\UMFD-1 (User-mode font driver)

These are standard system accounts that log on whenever a user session is created or updated (for example, when the desktop is prepared, graphics and fonts are initialized, or the session is reconnected). It is expected to see these together with logons involving the user’s account, even when there is no new interactive sign-in.

Putting it together:

• The SYSTEM account is creating a type 11 logon for the existing Microsoft account.
• DWM-1 and UMFD-1 logons around the same time are normal session-related activity.
• Seeing the same Security ID / Account Name as the normal sign-in in these events is expected because Windows reuses the user’s identity for background tasks and session maintenance.

So, yes: it is normal to see logon events with the user’s own Security ID and account name, initiated by SYSTEM and accompanied by DWM-1 and UMFD-1 logons, even when not actively using the laptop.

---

References:

• Invalid client IP address in security event ID 4624 in Windows 7 and Windows Server 2008 R2
• Some security events do not log the name of the user account that makes Local Security Policy changes in Windows Server 2008, in Windows Vista, in Windows 7 or in Windows Server 2008 R2