Logging admin access to workstations

From: Alan Cooper (imalcooper@yahoo.com)
Date: 03/13/02 

Date: Wed, 13 Mar 2002 10:22:25 -0800 (PST)
From: Alan Cooper <imalcooper@yahoo.com>
To: security-basics@securityfocus.com

I have a potential hacker on our corporate LAN who has
network-wide administration rights and may be copying
confidential files from several executive
workstations. This is a Windows environment and the
workstations involved are Windows 2000 Pro and NT.
The person suspected is extremely sharp and I need to
do this without her knowledge. It is unlikely that
we could use a keyboard-logging program since she is
using a laptop (asking for the laptop may arise her
suspections). She also VPN’s from home and I have no
access to her home systems.

Is there a program that we can run on Win 2000 and NT
workstations that will log all access attempts, tell
me what they are doing if access is granted, their IP
address, time of day, etc? Is there a better way
approach this problem?

Thanks for your help.

__________________________________________________
Do You Yahoo!?
Try FREE Yahoo! Mail - the world's greatest free email!
http://mail.yahoo.com/

Relevant Pages

  • RE: Logging admin access to workstations
    ... Logging admin access to workstations ... using a laptop (asking for the laptop may arise her ... access to her home systems. ... Try FREE Yahoo! ...
    (Security-Basics)
  • New laptop means new profile, new headaches....
    ... profile to do it all, doesnt want to log on with different accounts. ... My mistake was joining his laptop to the office domain (Laptop is XP ... "remembered" is that both his home and office workstations logged on ... POP configuration instead of a direct Exchange link. ...
    (microsoft.public.windows.server.sbs)
  • Re: Office 2003 SP2 false detection?
    ... server from re-applying Office 2003 SP2 to all my workstations last night. ... One user with a laptop took his laptop home last night, ... the network and did not get SP2 reapplied to it by my WSUS server, ...
    (microsoft.public.officeupdate)
  • Re: Logging admin access to workstations
    ... enable auditing for those objects as well. ... workstations involved are Windows 2000 Pro and NT. ... access to her home systems. ... Try FREE Yahoo! ...
    (Security-Basics)
  • I think I setup my home laptop wrong...going back...
    ... SBS2003>Switch >XP Pro Workstations ... I recently purchased a laptop partly for my wife to use at home (with XP ... so it got most of its "settings" from the server ...
    (microsoft.public.windows.server.sbs)