Possible unwanted access to computer

Hello,

one user in my company alerted me that someone could be making access to her computer when she's absent and the computer is on and locked.

She has a Windows 8 workstation and uses the alt+F4 combo to login / logout; she uses the Windows+L combo to lock the workstation.

The thing is that there are circumstances when she's not at her PC and when she's back ATL+F4 brings up "Switch user" and not "Shutdown the system" as usual.

The windows registry events viewer evidences several 4624 access events in the periods the computer should've been locked but I'm not sure those are real login attempts.

Have you some advice that could help me here?

Thanks in advance

 

Try describe your problem here
http://www.bleepingcomputer.com/forums/f/103/am-i-infected-what-do-i-do/

 

Very cool link, it surely will help me to see if there were real accesses or not.

On the other hand, I was thinking about sniffing traffic from / to that PC next time .... if nothing suspect comes from that the only problem left is phisical access to the PC and that is a problem she has to deal with for herself (changing password and not storing it where other people can read it, for example, LOL)

Many thanks for your help