Re: a forensic question

From: Privacy, please (no.spam@wanted.here)
Date: 02/27/03 

From: "Privacy, please" <no.spam@wanted.here>
Date: Wed, 26 Feb 2003 22:23:53 -0500

"Doug Fox" <dfox168@hotmail.com> wrote in message
news:Zgf7a.100208$Zr%.49692@news01.bloor.is.net.cable.rogers.com...

> The user also swore that he turned off the PC before leaving the
workplace.
> When he came back the office the next day, the PC was on. Checked Event
> Viewer | System Log and Security Log. The System Log shows that the PC
was
> actually turned off and on as he said, but the Security Log does not have
> any entry concerning user logging in.
>
> Any suggestions?

Check the BIOS for any 'Wake on' settings - 'Wake on LAN' would be an
excellent place to start. Some BIOS sets also have an option to
automatically start the machine at a specific time.

Relevant Pages

  • Re: Boot problems - How to debug / see an error message ?
    ... I would look in the System log and not the Security log. ... > up or this current successful boot up: ... > Alerter service, although I have so far failed to understand it. ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: WINS could not start - Problem with logs
    ... The security log is full of Success Audit events ... >> Reading the system log is a problem. ... In management console reading the ... Clicking on the invisible list shows some events are empty ...
    (microsoft.public.backoffice.smallbiz2000)
  • Re: Account lockouts
    ... I fond a SAM error in my system log that I ... > Any way here is the real problem I had been unlocking accounts all ... > the locks didn’t show up. ... > security log and they seem to be appearing now. ...
    (microsoft.public.windows.server.active_directory)
  • Event View
    ... launch Event View, the system log displays with 16,226 ... however when I select security log of Application ... they show they are empty (sometimes security log will ... If I reselect system log, ...
    (microsoft.public.win2000.general)
  • Re: a forensic question
    ... As far as the workstation being "on" in the morning.... ... The System Log shows that the PC ... > actually turned off and on as he said, but the Security Log does not have ... > any entry concerning user logging in. ...
    (comp.security.misc)