RE: WinXP Login Logs

From: Giraldo Alonso Suárez (giraldo.alonso_at_cigb.edu.cu)
Date: 01/19/05

  • Next message: David Gillett: "RE: Remote Desktop vs VPN on Windows 2003"
    To: "Bob Kurth" <Bob.Kurth@fcserv.com>, <security-basics@securityfocus.com>
    Date: Wed, 19 Jan 2005 14:45:51 -0400
    
    

    Hi,
    In System Properties Windows -> Advanced -> User Profiles Settings appear the profiles stored on the computer with date of modification (last date of logging).

    -----Original Message-----
    From: Bob Kurth [mailto:Bob.Kurth@fcserv.com]
    Sent: Friday, January 07, 2005 3:58 PM
    To: security-basics@securityfocus.com
    Subject: RE: WinXP Login Logs

    Bruno et al:

    It is very likely that the janitorial staff are using your PC's/network
    during the night. It would seem unusual that they could log on to the
    workstations to use them, especially since you are using WinXP. If you
    can pinpoint the actual workstations they are using, you may want to do
    a walk around before or after normal business hours. Seems to me it is
    highly likely that some end user has pulled out the Post-It notes to
    help them remember their password. All other responses aside, this is
    the simplest explanation for what's happened.

    Robert Kurth, CISSP

    -----Original Message-----
    From: Bruno Guedes Souto [mailto:brunoguedes@gmail.com]
    Sent: Thursday, January 06, 2005 9:21 PM
    To: security-basics@securityfocus.com
    Subject: Re: WinXP Login Logs

    Thanks for all the help guys. Tomorrow I'll see.The computers don't
    have any kind of "secret" information or something like that. I think
    there are just janitors or something like that "curious" about. I
    don't know if they have logged in, I just assumed it. The room gets
    locked during night but there are several ways to get a key. So i just
    wanna to discover the reason and what is happening. About the sudden
    "power loss" could i test it? I mean, if I pull the plug off the wall,
    wait a few minutes and then put it back again ,if such mechanism is
    there would the pc boot up?

    Regards

    Bruno Souto

    On Fri, 7 Jan 2005 08:27:51 +1000, Mitch Pope <mitch@bigbridge.com.au>
    wrote:
    > Turn on "Display last user" in the local security policy. That way
    when you
    > press control+alt+del after bootup it will show the last username in
    the
    > login username box.
    >
    > Another thing to be aware of is computers configured to startup on
    detection
    > of fresh power. So if power drops out through the night and then
    comes back
    > a few minutes later the computers may start up by themselves. But
    that
    > however does not explain them being used.
    >
    > Mitch
    >
    > ----- Original Message -----
    > From: "Bruno Guedes Souto" <brunoguedes@gmail.com>
    > To: <security-basics@securityfocus.com>
    > Sent: Thursday, January 06, 2005 10:45 PM
    > Subject: WinXP Login Logs
    >
    > > Suddenly here in my work, some PCs are being turned on by "ghosts"
    > > during night/clean periods and they are being used! How can I know
    the
    > > last person who logged in? Are there some kind of login logs in win
    > > xp?
    > >
    > > Regards
    > >
    > > Bruno Souto
    > >
    > >
    >
    >


  • Next message: David Gillett: "RE: Remote Desktop vs VPN on Windows 2003"