Outlook 2016 Outlook randomly unhides from taskbar

Status
Not open for further replies.

max221

Member
Outlook version
Outlook 2016 32 bit
Email Account
IMAP
I'm running Outlook 2016 on Windows 10 Pro 1909.
I keep Outlook minimized to the taskbar, with the option "hide when minimized."
For the past couple of months, Outlook randomly maximizes (un-hides). It doesn't happen when it's checking for new email; I can't find any task, setting, or anything else that would trigger it. It's not a disaster, but quite irritating to have it launch while I'm in the middle of working on other things...
Any advice would be greatly appreciated--thanks!
 

max221

Member
Outlook version
Outlook 2016 32 bit
Email Account
IMAP
I've noticed that sometimes it maximizes from the taskbar when the desktop background changes. Aside from that, I still haven't found anything.
 

Diane Poremsky

Senior Member
Outlook version
Outlook 2016 32 bit
Email Account
Office 365 Exchange
I've been testing, watching for it to happen here, but so far, nothing. Another user had the same complaint. I'll ask if it happens when the bg changes.

ETA: I end up having outlook on screen maybe half the day, so its my habits that make it harder to repro.
 

max221

Member
Outlook version
Outlook 2016 32 bit
Email Account
IMAP
Thanks for taking a look at this. I changed the desktop background to change only once a day--sadly, the problem continued.
 

Vincenzo

Senior Member
Outlook version
Outlook 2016 32 bit
Email Account
IMAP
Something to consider trying is to use the Event Viewer (Start button>type Event Viewer).

As soon as the program unhides, open the Event Viewer and look under Windows Logs (most likely in the subsection Application or System) for an event at the minute that it happened. It may give you a hint as to what is causing the issue.
 

max221

Member
Outlook version
Outlook 2016 32 bit
Email Account
IMAP
Something to consider trying is to use the Event Viewer (Start button>type Event Viewer).

As soon as the program unhides, open the Event Viewer and look under Windows Logs (most likely in the subsection Application or System) for an event at the minute that it happened. It may give you a hint as to what is causing the issue.
Looking at the event viewer was an excellent idea; thank you.

I manually changed the desktop background, outlook unhid, and I got the following two events in the Security Log:

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<EventID>4624</EventID>
<Version>2</Version>
<Level>0</Level>
<Task>12544</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2020-07-14T14:22:16.641104000Z" />
<EventRecordID>1316223</EventRecordID>
<Correlation ActivityID="{1d301a31-59e2-0000-bb1a-301de259d601}" />
<Execution ProcessID="900" ThreadID="2492" />
<Channel>Security</Channel>
<Computer>LAPTOP-8ON6QGN5</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-18</Data>
<Data Name="SubjectUserName">LAPTOP-8ON6QGN5$</Data>
<Data Name="SubjectDomainName">WORKGROUP</Data>
<Data Name="SubjectLogonId">0x3e7</Data>
<Data Name="TargetUserSid">S-1-5-18</Data>
<Data Name="TargetUserName">SYSTEM</Data>
<Data Name="TargetDomainName">NT AUTHORITY</Data>
<Data Name="TargetLogonId">0x3e7</Data>
<Data Name="LogonType">5</Data>
<Data Name="LogonProcessName">Advapi </Data>
<Data Name="AuthenticationPackageName">Negotiate</Data>
<Data Name="WorkstationName">-</Data>
<Data Name="LogonGuid">{00000000-0000-0000-0000-000000000000}</Data>
<Data Name="TransmittedServices">-</Data>
<Data Name="LmPackageName">-</Data>
<Data Name="KeyLength">0</Data>
<Data Name="ProcessId">0x37c</Data>
<Data Name="ProcessName">C:\Windows\System32\services.exe</Data>
<Data Name="IpAddress">-</Data>
<Data Name="IpPort">-</Data>
<Data Name="ImpersonationLevel">%%1833</Data>
<Data Name="RestrictedAdminMode">-</Data>
<Data Name="TargetOutboundUserName">-</Data>
<Data Name="TargetOutboundDomainName">-</Data>
<Data Name="VirtualAccount">%%1843</Data>
<Data Name="TargetLinkedLogonId">0x0</Data>
<Data Name="ElevatedToken">%%1842</Data>
</EventData>
</Event>


Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<EventID>4672</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12548</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2020-07-14T14:22:16.641120500Z" />
<EventRecordID>1316224</EventRecordID>
<Correlation ActivityID="{1d301a31-59e2-0000-bb1a-301de259d601}" />
<Execution ProcessID="900" ThreadID="2492" />
<Channel>Security</Channel>
<Computer>LAPTOP-8ON6QGN5</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-18</Data>
<Data Name="SubjectUserName">SYSTEM</Data>
<Data Name="SubjectDomainName">NT AUTHORITY</Data>
<Data Name="SubjectLogonId">0x3e7</Data>
<Data Name="PrivilegeList">SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
SeDelegateSessionUserImpersonatePrivilege</Data>
</EventData>
</Event>
 

Vincenzo

Senior Member
Outlook version
Outlook 2016 32 bit
Email Account
IMAP
I'm not seeing anything that I can make sense out of.
But you are showing the xml view in the Details tab. What does it say in the General tab?
also in the box at the top, what type of event is this? ie Information, Error, etc.
 

Vincenzo

Senior Member
Outlook version
Outlook 2016 32 bit
Email Account
IMAP
Also, in the General tab, click on "Event Log Online Help" and see if you get lucky.
 

max221

Member
Outlook version
Outlook 2016 32 bit
Email Account
IMAP
Also, in the General tab, click on "Event Log Online Help" and see if you get lucky.
Sorry, I wasn't sure what to post.

A user's local group membership was enumerated.

Subject:
Security ID: SYSTEM
Account Name: LAPTOP-8ON6QGN5$
Account Domain: WORKGROUP
Logon ID: 0x3E7

User:
Security ID: LAPTOP-8ON6QGN5\
Account Name:
Account Domain: LAPTOP-8ON6QGN5

Process Information:
Process ID: 0x1a90
Process Name: C:\Windows\System32\svchost.exe

Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 7/13/2020 7:10:17 PM
Event ID: 4798
Task Category: User Account Management
Level: Information
Keywords: Audit Success
User: N/A
Computer: LAPTOP-8ON6QGN5
 

Vincenzo

Senior Member
Outlook version
Outlook 2016 32 bit
Email Account
IMAP
What does it say in these two places? see attached
 

Attachments

  • EV.JPG
    EV.JPG
    160.9 KB · Views: 249

max221

Member
Outlook version
Outlook 2016 32 bit
Email Account
IMAP
There's nothing under Application related by time signature. Here's what I get under Security which is related by time (there are several duplicates of these at each time).

Audit Success 7/17/2020 3:48:43 PM Microsoft Windows security auditing. Event 4672 Special Logon
Special privileges assigned to new logon.

Subject:
Security ID: SYSTEM
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3E7

Privileges: SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
SeDelegateSessionUserImpersonatePrivilege








Audit Success 7/17/2020 3:54:23PM Microsoft Windows security auditing. Event 4624 Logon

An account was successfully logged on.

Subject:
Security ID: SYSTEM
Account Name: LAPTOP-8ON6QGN5$
Account Domain: WORKGROUP
Logon ID: 0x3E7

Logon Information:
Logon Type: 5
Restricted Admin Mode: -
Virtual Account: No
Elevated Token: Yes

Impersonation Level: Impersonation

New Logon:
Security ID: SYSTEM
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3E7
Linked Logon ID: 0x0
Network Account Name: -
Network Account Domain: -
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x378
Process Name: C:\Windows\System32\services.exe

Network Information:
Workstation Name: -
Source Network Address: -
Source Port: -

Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.





Audit Success 7/17/2020 4:02:34PM Microsoft Windows security auditing. Event 5379 User Account Management

Credential Manager credentials were read.

Subject:
Security ID: LAPTOP-8ON6QGN5\XXXX
Account Name: XXXX
Account Domain: LAPTOP-8ON6QGN5
Logon ID: 0x8A1AA
Read Operation: Enumerate Credentials

This event occurs when a user performs a read operation on stored credentials in Credential Manager.
 

Vincenzo

Senior Member
Outlook version
Outlook 2016 32 bit
Email Account
IMAP
I don't see anything in those events that gives me any clue.

I also tried to reproduce this by hiding Outlook when minimized, and setting the desktop background to change every minute, but it does not unhide on my computer.
 

max221

Member
Outlook version
Outlook 2016 32 bit
Email Account
IMAP
The problem continues... It also started on my work laptop last week. My home laptop is a Lenovo T570, work is a Lenovo L380. The work laptop has much less non-essential software, so I am truly puzzled--unless this is some peculiarity specific to Lenovos?
 
Status
Not open for further replies.
Similar threads
Thread starter Title Forum Replies Date
kburrows Outlook Email Body Text Disappears/Overlaps, Folders Switch Around when You Hover, Excel Opens Randomly and Runs in the Background - Profile Corrupt? Using Outlook 0
K Outlook 2019 Randomly Disconnecting from Gmail Servers Using Outlook 8
P Outlook Randomly Not attaching (attachment file) Using Outlook 0
O Outlook 2013 deleting emails randomly Using Outlook 0
B Outlook 2003 randomly not auto forwarding Using Outlook 0
S Outlook 2007 Rules randomly stopping working (non-Exchange Server) Using Outlook 6
B SelectionChangeEventHandler randomly disappears in Outlook 2007 Outlook VBA and Custom Forms 1
P Yahoo/IMAP folder rename by Outlook desktop 365 Using Outlook 0
A Outlook 2019 folder counter Using Outlook 0
A Relocate Search Bar in Outlook Using Outlook 3
e_a_g_l_e_p_i Need clarification on 2-Step Verification for Gmail using Outlook 2021 Using Outlook 9
L Opening People Outlook 2021 Using Outlook 2
e_a_g_l_e_p_i Outlook 2021 not letting me setup my Gmail using pop Using Outlook 1
Geldner Problem submitting SPAM using Outlook VBA Form Outlook VBA and Custom Forms 2
P VBA to add email address to Outlook 365 rule Outlook VBA and Custom Forms 0
M Outlook 2016 outlook vba to look into shared mailbox Outlook VBA and Custom Forms 0
P Can no longer sync Outlook with iPhone calendar after iPhone update to 17.1.1 Using Outlook 2
O Outlook - Switch from Exchange to IMAP Using Outlook 2
e_a_g_l_e_p_i Is it possible to have a reminder in Outlook 2021 for every 90 days Using Outlook 3
farrissf Outlook 2016 Optimizing Email Searches in Outlook 2016: Seeking Insights on Quick Search vs Advanced Search Features Using Outlook 0
C Advanced search terms for "Outlook Data File" Using Outlook 1
N Reply to Outlook messages by moving messages to a specific Outlook folder Outlook VBA and Custom Forms 1
O How to find out the domain and server settings that my Outlook is using? Using Outlook 2
A Outlook 365 (OutLook For Mac)Move "On My Computer" Folder Items From Old To New Mac Computer Using Outlook 3
H Integrating Alexa & Outlook Pro 2021 Using Outlook 2
Z Automatically adjust Outlook Reading Pane from bottom to right depending on portrait or landscape window Using Outlook 1
Rupert Dragwater Background colors not saving in Outlook 365 Using Outlook 15
petunia Outlook tasks module sunsetting? Exchange Server Administration 3
G Save emails as msg file from Outlook Web AddIn (Office JS) Outlook VBA and Custom Forms 0
D Outlook VBA forward the selected email to the original sender’s email ID (including the email used in TO, CC Field) from the email chain Outlook VBA and Custom Forms 3
U Outlook 2021 not showing contact cards in Searches Using Outlook 1
C Outlook - Macro to block senders domain - Macro Fix Outlook VBA and Custom Forms 2
H Outlook 365 O365 outlook calendar item editing Using Outlook 1
J Outlook 365 html inline images Using Outlook 0
Rupert Dragwater How to get Outlook 365 to open from websites Using Outlook 5
S Why do I have to close and reopen Outlook for macros to work? Outlook VBA and Custom Forms 2
J Outlook 2021 ScanPST errors (yet again ... sorry): repair button missing Outlook 2021 Using Outlook 0
HarvMan Outlook 365 - Rule to Move an Incoming Message to Another Folder Using Outlook 4
K Moved pst to new computer, now Gmail not coming into Outlook Using Outlook 7
S Email Macros to go to a SHARED Outlook mailbox Draft folder...NOT my personal Outlook Draft folder Using Outlook 2
F Running Scripts in Outlook 2021 Using Outlook 0
Nufc1980 Outlook "Please treat this as private label" auto added to some emails - Help. Using Outlook 3
S Outlook 2019 Custom outlook Add-in using Visual Studio Outlook VBA and Custom Forms 0
V Outlook macros no longer run until VB editor is opened Outlook VBA and Custom Forms 0
R Outlook 365 How to integrate a third-party app with Outlook to track email and sms? Using Outlook 2
e_a_g_l_e_p_i I can't believe what I am seeing when trying to install Outlook 2021 Using Outlook 9
Kika Melo Outlook Calendar deleted appointments not in Deleted Items folder Using Outlook 3
P How to get a QR code for automatic signin with Outlook for iOS Using Outlook 5
J Migrating Outlook Using Outlook 1
Retired Geek Outlook for the MAC with Yahoo accounts now very broken Using Outlook 9

Similar threads

Top