I've had my Surface for about 3 years, and I've never noticed this happen before, but now it's happened twice in the past month:
For about a year now, when I head out to work I've been leaving my Surface on and closed, but active so that it can process data in the background. When I come back It's always at my account login screen just as I left it. In the past month, I've twice found it logged all the way out to showing both the admin and my user account. I've never seen this before, and I'm concerned something/someone may have logged into the admin account remotely. (But remote desktop is disabled.)
The first time, it had powered off and quit my open programs. I looked at event viewer and saw nothing alarming, just several Avast 'policy change' entries, so I assumed Avast had updated.
The second time, my apps were still running, and the event viewer showed nothing at all of obvious interest, again a few Avast 'policy change' entries right after I closed the lid at 7am. While I was out and my family was home, there was a single 'system uptime' entry at noon. And then when I got home and opened the lid there were a bunch of entries.
I'm using Windows 8.1 on a Surface Pro 3. I have not updated for the Spectre/Meltdown issues because I haven't had time to figure out where to download the patch. (I don't feel comfortable giving Microsoft free reign to perform updates since the Windows 10 push.) Remote connections are disabled, and Avast and MalwareBytes find no problems. Any advice would be appreciated!
Edited by gm1138, 21 March 2018 - 02:32 PM.