Multiple failed logon attempts from "Windows Manager\DWM-#"

Hello,
During a recent network audit, we noticed that Windows 8, and server2012 machines have multiple failed logon attempts from the users "Window Management\DWM-1" (-2 -3 etc). After a bit of research I have found multiple articles on the Desktop Windows Manager hogging resources, or failing to start, but I cannot seem to find anyone who has experienced (or noticed) that these service accounts are creating failed logon attempts. I was hoping someone might be able to shed some light on this.
LVL 1
CCtechAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Rob MinersCommented:
If you are using McAfee Agent (MA) 4.8 P1 check this link for relevent information.
https://kc.mcafee.com/corporate/index?page=content&id=KB81557

Because of Desktop Window Manager (DWM-X is the command), Agent-to-Server Connection (ASC) fails on Windows 2012 R2 servers and Windows 8 clients.
NOTE: The -X entry above is a random number for a user that Desktop Windows Manager creates.

Examples:
 window manager\dwm-1
 window manager\dwm-2
 window manager\dwm-3
 window manager\dwm-4

And this one for an update
https://kc.mcafee.com/corporate/index?page=content&id=KB56057
0
CCtechAuthor Commented:
Thank you for the reply Rob. Unfortunately, we are not using any mcafee products.
0
Rob MinersCommented:
Check with Task Manager on one of the systems for Users logged on as dwm-1, dwm-2, dwm-3 etc..
Then do a Clean Boot re applying items until you find out what software is causing the dwm user sessions.
https://support.microsoft.com/kb/929135/en-us

ref# http://social.technet.microsoft.com/Forums/windows/en-US/29a96616-c942-4d33-9a0b-c4fa5a20c6b4/why-is-desktop-windows-manager-12345-or-6-in-task-manager-in-windows-8?forum=w8itprosecurity#79974b8e-2ac1-438f-8527-80c5b7074ade

Also on a system with the problems run this command line and check the output

Type or copy/paste the below commands and then press the Enter key after each command.

wevtutil qe application "/q:*[System[(EventID=1000)]]" /rd:true /f:text /c:25 > "%userprofile%\Desktop"\EventID1000.txt

note: check for "Source: Application Error"

wevtutil qe application "/q:*[System[(EventID=1001)]]" /rd:true /f:text /c:25 > "%userprofile%\Desktop"\EventID1001.txt

note: check for "Event Name: AppHang"

Check the files for clues that may lead to a solution to your problem.

Also ensure that you have the latest device drivers installed.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Legacy OS

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.