1

Ok here we go my computer randomly enters the lock screen as if I had locked it. This will happen while I am actively using the computer. I need to track down the cause because I fear it will happen to other computers in the organization.

11 Spice ups
2

There can be several factors at play with which to eliminate.

You state while actively using. Does this constitute actual typing at the time of the lock or mouse movement at the time of the lock? I’m inferring to possible screen saver settings, I’ve seen users set screensavers to lock after 1 minute of inactivity.

I’ve also seen during typing when the keyboard acts as if the “windows” key is being held and then the letter ‘L’ is pressed, it will result in a locked screen.

Can you provide more details, frequency of the problem. Are there any periods of time where it does not happen? When did it start?

4 Spice ups
3

I would try a new keyboard and maybe running programs.

4

Was this machine upgraded from Windows 7? I had some issues with that in my company and it was extra registry keys in Windows 7 pertaining to the screen saver that carried through to Win 10 and had the computer a mess.

1 Spice up
5

I never ran into that particular thing with my Win7 updates, but anything is possible! I’d also check your Event Log viewer for those times to make sure nothing connected to you via RDP…

1 Spice up
6

Have you checked the lock screen setting under Settings>Accounts>Sign-in Options? There are several options there that work outside of the power scheme that lock the account. Worth a look see. I was having an issue where my PC would lock after 5-10 seconds of non activity and sure enough, dynamic lock was enabled

1 Spice up
7

@tacohinter09 I have checked the screen saver and none are set. I even tried toggling it off and on to see if anything changed, no dice. Regarding timing it seems random I can’t detect an interval. Occasionally it will happen back to back and then not for hours?

I can plug up and external keyboard

Regarding windows 7 an in place upgrade was not done. It was freshly installed windows 10…

Still Looking for answers. I have found the event Id 4800 and it looks like I am locking it but honestly I’m not. Also 4800 can indicate inactivity but I’m typing when it happens?

Arghhhh

8

I would definitely investigate the keyboard being the problem. Try a different one and see if the issue continues.

2 Spice ups
9

@toddpriest ​ Checked and dynamic lock is not enabled …

10

@tjollimore ​ Looking at event viewer event ID 4624 and there is a 2 min time difference. What in the event info would tip me off to a malicious actor?

11

You would see that event coming in from an outside address or another workstation ID, if it weren’t legitimate.

12

You’ve confirmed it is not an idle time issue, and it is not Dynamic locking is not enabled. Any special “scheduled” applications which want user access disabled temporarily? I would still consider the keyboard as a source of the problem, or some other input device. There are some apps for mice that lock the screen when you park the mouse in a corner, so that’s a possibility. I loved that feature on the Mac when I wanted a quick lock.

13

[Windows] - [L] will lock your computer.
Make sure the windows-key is not stuck or sticking. If possible try to swap the keyboard.

14

Are you on a laptop or desktop?
Recently ran into issue where a users magnetic band on their Fitbit/Apple Watch would lock their Dell 5500 laptop. Anytime the users band went near the bottom right corner of the wrist-rest area, the laptop would lock. The magnetic band was triggering the laptop’s switch making it think that the lid had closed. Thus locking the screen per the settings when closing the lid.

10 Spice ups
15

I’ve seen exactly the same problems as SworldyMe, If you have a couple of laptops stacked on top of each other then the magnetic closing on one lid can interact somehow with the laptop above/below’s switch and locking the device. A more common example would be stacked up ipads, the ones with the cases with folding covers tend to have magnets on which do the same thing.

1 Spice up
16

My guess is your AD profile is being used as a service profile somewhere or other

17

Does your Windows key have the same or weaker tactile response as the Ctrl and Alt keys? Has debris made its way below the key cap? Do you have programmable function keys?

18

I have had the lock occur with an external keyboard installed @swordlyme ​ yes its a laptop cheers. Here is the event logged right before the lock event.
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 10/30/2020 10:53:34 AM
Event ID: 4688
Task Category: Process Creation
Level: Information
Keywords: Audit Success
User: N/A
Computer: redacted Computer-name.domain info
Description:
A new process has been created.

Creator Subject:
Security ID: SYSTEM
Account Name: redacted Computer-name$
Account Domain: Domain
Logon ID: 0x3E7

Target Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0

Process Information:
New Process ID: 0x3228
New Process Name: C:\Windows\System32\LogonUI.exe
Token Elevation Type: %%1936
Mandatory Label: Mandatory Label\System Mandatory Level
Creator Process ID: 0x398
Creator Process Name: C:\Windows\System32\winlogon.exe
Process Command Line: “LogonUI.exe” /flags:0x0 /state0:0xa3d4f055 /state1:0x41c64e6d

Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy.
Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account.
Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group.
Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.

Event Xml:
](http://schemas.microsoft.com/win/2004/08/events/event">) ;


4688
2
0
13312
0
0x8020000000000000

7229523


Security
redacted Computer-name.domain info



S-1-5-18
redacted Computer-name$
Doamin
0x3e7
0x3228
C:\Windows\System32\LogonUI.exe
%%1936
0x398
“LogonUI.exe” /flags:0x0 /state0:0xa3d4f055 /state1:0x41c64e6d
S-1-0-0
-
-
0x0
C:\Windows\System32\winlogon.exe
S-1-16-16384

19

Have you changed your password recently? If not, please do so and report if the issue is still happening.

20

@tacohunter09 ​ Password changed lets see …

1 Spice up