My PC has two local accounts, Ka and Ve. After starting the computer, I signed in only to Ka. When I later tried to shut down, Windows warned that someone else was still using the PC and might lose unsaved work. I had not intentionally signed in to Ve during that boot.
I shut down anyway, then checked the system after restarting. `qwinsta` showed no unexpected active sessions, `net user` showed no unknown accounts, and `netstat -ano` showed nothing suspicious. Remote Desktop was disabled (`fDenyTSConnections = 0x1`), and Microsoft Defender reported that real-time protection, behavior monitoring, tamper protection, and related features were enabled and up to date.
Fast Startup is enabled, and Windows is set to use sign-in information to finish setting up the device after updates or restarts for both accounts. Restartable apps are not being restored, and neither user uses sleep mode. There are no shared folders. The warning happened only once and has not appeared during later shutdowns.
Could Windows have restored or briefly initialized the other account because of Fast Startup, an update, or a background task? Or is this more likely just a one-time Windows glitch?
2 Answers
A shared folder is not required for Windows to show that warning. It can be triggered by a stale or briefly created user session, an update-related background task, or a session cleanup problem. Since the checks showed no unknown accounts, no active sessions, and no suspicious Defender results—and the warning never returned—it sounds more like a transient Windows issue than evidence that someone accessed the PC.
Windows can initialize parts of another user profile for background tasks, updates, or sign-in setup without that person actively opening a desktop session. Fast Startup can also make shutdown behave more like hibernation, preserving some system state. Check each account’s sign-in options, especially the setting that lets Windows use sign-in information to finish setup after updates or restarts. Since Fast Startup and that option are enabled, they’re plausible explanations.
Fast Startup and the automatic sign-in setup option are enabled for both accounts, but restartable-app restoration is disabled. Neither of us uses sleep mode, so I’m hoping this was just Windows temporarily preparing the other profile.
That makes sense. The message appeared only that one time, and I used the computer normally afterward without seeing it again, so it may have been a temporary session or synchronization glitch.