Most machines that have multiple users that log into those machines are reporting last logon user incorrectly. Users are being seen as logging on at the same time and those times do not correspond to any security log login events.
Example:
Username Domain Displayname Ip address Logon time
derrick.almazan XX derrick.almazan 99.20.140.113 07/09/2016 1:51:37 PM
arturo.roque XX arturo.roque 99.20.140.113 07/09/2016 1:51:37 PM
Andrea.CaballeroXX Andrea.Caballero99.20.140.113 07/09/2016 1:51:37 PM
Ndifon.Amstrong XX Ndifon.Amstrong 99.20.140.113 07/09/2016 1:51:36 PM
Donaldo.Sanchez XX Donaldo.Sanchez 99.20.140.113 07/09/2016 1:51:29 PM
derrick.almazan XX derrick.almazan 99.20.140.113 07/08/2016 3:47:50 AM
Rosalina.Sablad XX Rosalina.Sablad 99.20.140.113 07/07/2016 5:48:57 AM
ray.reveles XX ray.reveles 99.20.140.113 07/07/2016 5:48:56 AM
marites.moreno XX marites.moreno 99.20.140.113 07/07/2016 5:48:49 AM
Hien.tran XX Hien.tran 99.20.140.113 07/07/2016 5:48:49 AM
long.truong XX long.truong 99.20.140.113 07/07/2016 5:48:49 AM
ismael.aguilar XX ismael.aguilar 99.20.140.113 07/07/2016 5:48:48 AM
samuel.rangel XX samuel.rangel 99.20.140.113 07/07/2016 5:48:48 AM
Andres.VillagomeXX Andres.Villagome99.20.140.113 07/07/2016 5:48:48 AM
gloria.pino XX gloria.pino 99.20.140.113 07/07/2016 5:48:47 AM
barry.calayag XX barry.calayag 99.20.140.113 07/07/2016 5:48:47 AM
