Re: Weird Logins

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 11/10/05


Date: Thu, 10 Nov 2005 12:30:41 -0600

Enable auditing of logon events on her computer in Local Security Policy and
then view logon entries in the security log to see what is going on and
proceed from there. The events will have a logon type and a timestamp. Type
7 shows the computer was unlocked. Make sure you reset her password ASAP
and you may need to do a clean install of the operating system. --- Steve

http://www.windowsecurity.com/articles/Logon-Types.html

"asdf" <asdf@asdf.com> wrote in message
news:1NDcf.68289$rE2.11111@fe10.lga...
> one of our users is complaining that someone is loging in to her computer.
> when she leaves she locks her computer but sometimes when she comes back
> it is unlocked. Noone else knows her password. Even if i it was reset
> through active
> directory it would show since then she would know that someone changed it.
> To me that leaves only one option and that is that someone has installed a
> keylogger
> like spector to get her password. System is running Symantec Corporate
> Antivirus 9.1
> but those keylogger have a way of avoiding detection. What are other
> things
> that could
> be causing this. What are other ways of troubleshooting this problem.
>
> thanx a million for all the responses.
>
>



Relevant Pages

  • Re: Weird Logins
    ... Enable auditing of logon events on her computer in Local Security Policy and ... > but those keylogger have a way of avoiding detection. ...
    (microsoft.public.win2000.security)
  • Re: Weird Logins
    ... thats why i think that it's a keylogger or similar. ... > Enable auditing of logon events on her computer in Local Security Policy ... Make sure you reset her password ASAP ...
    (microsoft.public.win2000.security)
  • Re: Weird Logins
    ... thats why i think that it's a keylogger or similar. ... > Enable auditing of logon events on her computer in Local Security Policy ... Make sure you reset her password ASAP ...
    (alt.computer.security)
  • Re: The Local Policy of This System Does Not Permit You to Logon Interactively
    ... As to the Local security policy, all my other workstations that are working ... Someone told me today that they have heard of this happening to workstations ... > the OU and were allowed to logon, did you check the Local Security Policy ... > settings to deny the logon. ...
    (microsoft.public.win2000.security)
  • RE: find on which computer is connected a user
    ... You may try to enable the policy "Audit Logon Events" and then audit the ... Write events to the event log of a specified server concerning the status ...
    (microsoft.public.windows.server.general)