Re: Unidentified User

From: Richard McCall [MSFT] (richmcc_at_online.microsoft.com)
Date: 01/19/04 

Date: Mon, 19 Jan 2004 09:52:38 -0500

Open the local Security Policy under Administrator tools
Under Audit policies Select Audit Logon and Logoff Success and Failure.
The next time you suspect that someone is logging into your machine then a
logon\logoff success will show up in the security event log 

-- 
Richard McCall [MSFT]
"This posting is provided "AS IS" with no warranties, and confers no
 rights."
"Michael Neff" <michael.neff@elevatorcontrols.com> wrote in message
news:067801c3de93$b0313700$a501280a@phx.gbl...
> Someone is using my computer after working hours.
>
> We are on a network, however we do not have a network
> administrator at this time.
>
> How do I identify the user name?
>
> Please help!!!
>
> Thank you,
>
> Michael Neff

Relevant Pages

  • Re: Network or security
    ... I login into the win4 box as local administrator? ... Admin tools, Local Security Policy ... do not get wild in there!!! ... just drill to the Audit Policies and enable audit for logon fail ...
    (microsoft.public.win2000.security)
  • WinXP Pro SP3 Audit Policies, Cannot Change
    ... I am member of "Administrators" ... Local Security Policy, Audit Policies ...
    (microsoft.public.windowsxp.help_and_support)