Re: User Activities
- From: "Al Dunbar" <AlanDrub@xxxxxxxxxxxxxxxxxxx>
- Date: Thu, 24 May 2007 19:14:47 -0600
"tslu" <tslu69@xxxxxxxxx> wrote in message
news:ubAdcNmnHHA.3512@xxxxxxxxxxxxxxxxxxxxxxx
Hi, I have a situation where an employee had logged into the domain
network as an administrator and got into a PC to delete certain folders in
that PC.
Can I obtain information such as :
1. Which PC the administrator logged in from
2. Which PC the administrator got into
3. Time and date the incident happen
You don't give much to go on. For example, do you know the administrator
account that was used? Do you know who it was that did this? Is that person
authorized to use the administrator account.
And, if you do not know on which PC this happened, how did you become aware
that any folders went missing?
As to the specifics:
1. I don't know of a standard way to determine this. we do it by examining
logs created by our logon scripts, but even then, a rogue administrator
would be able to cover his tracks. I have been told that ad2003 may have a
way of doing this, but the feature needs to be enbaled, as it is off by
default.
2. you could search the hard drives of all workstations to see which one has
these particular folders missing. Not much good if it was unique information
and you want it back.
3. if you are not already doing extensive auditing, this may not be
possible. That said, it might be worth having a close look at event viewer
to see what kinds of events are being recorded there.
/Al
.
- Follow-Ups:
- Re: User Activities
- From: tslu
- Re: User Activities
- References:
- User Activities
- From: tslu
- User Activities
- Prev by Date: User Activities
- Next by Date: Re: Trouble Following KB Article 325349
- Previous by thread: User Activities
- Next by thread: Re: User Activities
- Index(es):
Relevant Pages
|
