| Forum Home | ||||
| Press F1 | ||||
| Thread ID: 82355 | 2007-08-24 11:54:00 | How to check log-in user? | yorkshirekid (9033) | Press F1 |
| Post ID | Timestamp | Content | User | ||
| 584306 | 2007-08-24 21:35:00 | Your computer was restarted and you think someone logged in while you weren't around? Anyway - for my post, I'm going to assume the following: Your PC is a member of a domain (and thus requires you to press Ctrl-Alt-Del to login) Are you sure the IT Department hadn't pushed out some Windows Updates (or something similar) which required the PC to be reset? Anyway, Your first port of call would be to check the last logged in username - this usually sits in the username field of the login prompt and many IT Departments don't bother clearing this on logout. Then, as mentioned above - try the Event Logs, although if patience isn't your forte, browse to C:\Documents and Settings\ and read off the usernames. Now before you jump to any conclusions based on this - this just tells you who has logged into the PC since it was setup/configured - the users could have logged in many years ago before you got it. Alternatively, ask the IT Department. I doubt they'll do much - many IT Departments are too busy to follow the delusions of paranoia. You should also remember it is a Work PC - not yours, works'. They own it, not you, and so most companies allow any employee to log into any PC on their network (even though most companies provide a PC per user), so even if you do find "evidence" that someone else logged in, I doubt much will happen from there. Personally I'd much rather trust my colleagues than believing that they're lying to me. Anyway, many companies use NTFS, so assuming the permissions have been setup properly, anyone who logs into your PC would be unable to get into your data anyway. Though I am curious - why are you worried someone logged into your company PC? You're worried someone saw your porno collection? |
Backlash (11925) | ||
| 584307 | 2007-08-25 02:02:00 | Backlash - thanks . Appreciate the help but don't be sarcastic; it was just a question . And as I work with a PC all day I don't trust anyone at all . Ever . There is a suspicion one of the IT staff is 'dirty' and I want to ensure I'm not a victim . So, harmless question . Please [all] stop thinking like the devil - I'm just seeking the collective advice of people here . Now I have full admin rights on my PC . Yes, I do log-in . WU are never done by the IT staff - they leave that to me . You say: Anyway, Your first port of call would be to check the last logged in username - this usually sits in the username field of the login prompt and many IT Departments don't bother clearing this on logout . I know that . How come I'm asking for help if the username was left in the login window? Come on, I'm not that stupid . You ask me to look in the Event log . I have posted earlier that I've done this . See my 6 . 24am post . The usernames under the c drive are not any help either; just as you said . And I have loads of patience - just tell me what I need do anyone please . I just thought there would be some log somewhere that would reveal what I'm after . Thanks |
yorkshirekid (9033) | ||
| 584308 | 2007-08-25 02:11:00 | I have loads of patience - just tell me what I need do anyone please . By the look of your replies you don't seem to have any patience . People are trying to help you the best they can :-) |
LiquidSolidity (1589) | ||
| 584309 | 2007-08-25 10:47:00 | Anyone have any fresh suggestions please? | yorkshirekid (9033) | ||
| 584310 | 2007-08-25 11:26:00 | www.pcanswers.co.uk that might help? |
apsattv (7406) | ||
| 584311 | 2007-08-25 20:36:00 | Found it thanks. I spent some time googling [thank you apsattv] which took some patience [liquid boy] ;-) Here's what to do: Start\run type secpol.msc then under local policies\audit policy, check security setting is set to either success\failure\both (depending on what you want to audit.) |
yorkshirekid (9033) | ||
| 584312 | 2007-08-27 07:18:00 | You will find that this is all part of configuring what you record in your Event Viewer. So people asking you to check your Event Viewer assumed that you had set this up correctly to audit the log on/off. In future - please do not be so impatient. Some (and only some) of the people here actually know what they are talking about and are trying to help as best they can without assuming anything. Did you find out who/when was logging on? |
Bozo (8540) | ||
| 1 2 | |||||