Logon Event (Event ID 4648). Events only log during a successful remote desktop in to the computer.

[ItsChefMatt]

We have a computer that isn't allowed to be connected to the internet but we have it set up so that we can remote in to it to work on it. It is not connected to our domain at all but is still throwing this logon error despite no one trying to log in with this username. Here is an image with the event viewer and how much it logs and how consistently:

https://imgur.com/oRG3I5A

View: https://i.imgur.com/oRG3I5A.pngThings
I have looked at - Not connected to work domain - Not a current user that is allowed locally or even exists locally - Doesn't show anywhere in the Registry - Can't find any files relating or calling for the acc

Continue reading...