DWM account showing logon type 2

Jeramie Brown 6 Reputation points
2020-09-09T23:10:52.783+00:00

I found an interactive logon log entry on one of our Domain Controllers for one of the DWM virtual accounts on that machine. Why and how would a DWM virtual account create an interactive logon session?

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,921 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,431 questions
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vicky Wang 2,731 Reputation points
    2020-09-10T09:11:16.757+00:00

    Hi,

    Thank you for posting in our forum

    This logon behavior is initiated by the account of the DWM virtual machine itself. From the AD perspective, we can see if the event itself has recorded some information,

    such as which process initiated it. Specifically, we need to investigate why the DWM account will have interactive login, or start the investigation from the account itself.

    Hope this information can help you

    Best wishes
    Vicky

    0 comments
  2. Vicky Wang 2,731 Reputation points
    2020-09-14T07:37:24.477+00:00

    Hi,
     
    Just checking in to see if the information provided was helpful. Please let us know if you would like further assistance.
     
    Best Regards,
    Vicky

    0 comments
  3. Vicky Wang 2,731 Reputation points
    2020-09-21T08:48:34.167+00:00

    Hi,
     
    Just checking in to see if the information provided was helpful. Please let us know if you would like further assistance.
     
    Best Regards,
    Vicky

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.