Hi, Could the wrong user be a domain admin? Could other domain user log on to use the computer? I suggest enabling Audit Policy to capture the related log, then upload them from Event Viewer to SkyDrive. Security Audit Policy Reference http://technet.microsoft.com/en-us/library/dd772623(WS.10).aspx [Security Settings\Local Policies\Audit Policy] In the right pane, enable Audit account logon events with Success and Failure, enable Audit logon events with Success and Failure. Best Regards, NikiPlease remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Well this is awkward. We have had this issue a few months ago, and now it appeared again on a completely new computer. A user first logged on using a domain admin account just to set up some stuff. Then the real owner got the computer and logged on. Some installations happened through Configuration Manager and the user went away. When he came back to his computer, the computer was locked. But when he was about to enter his password, the wrong user appeared to be logged on. Investigating the PC, there was no local user profile created for that user, and no event logs mentioning this wrong users name. The objectSid of the user which appeared incorrectly as logged on at the lock-screen is 01 05 00 00 00 00 00 05 15 00 00 00 09 24 71 7E B8 0E 29 4C 54 1F D0 7D C0 A0 00 00 Is there some kind of bug that can happen here when a screen is locked and the lock-process try to find the current logged-in user?

Hi, Could the wrong user be a domain admin? Could other domain user log on to use the computer? I suggest enabling Audit Policy to capture the related log, then upload them from Event Viewer to SkyDrive. Security Audit Policy Reference http://technet.microsoft.com/en-us/library/dd772623(WS.10).aspx [Security Settings\Local Policies\Audit Policy] In the right pane, enable Audit account logon events with Success and Failure, enable Audit logon events with Success and Failure. Best Regards, NikiPlease remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.