Left a computer on running PRTK over the weekend (It's been running all week and was close to being done). Came in on Monday to find PC had rebooted. Forgot to disable automatic update restarts!!
But in searching for what happened I went to my event logs and found one (EVENT ID 2) that states "Geolocation positioning has been disabled by the user". This was at 1016PM. No one was at the computer at that time…
I am assuming the text is misleading and does not mean someone at that time disabled this, but more likely a service tried using it and found it was disabled and reported it as such.
There are several occurrences of this same message in the logs history which makes me think this. But for future understanding when doing an exam and seeing some message stating '…diabled by the user.' it may not always mean a person was behind the keyboard, right?
You should add a note about it being a (stupid) Windows 10 OS.
jaclaz