Other Admin Hacking My Registry Etc.

I would go here and download this program for complete logging of all keystrokes. Can be emailed directly to you. And I would send it to another email address, as any administrator can access anyones mail! Good luck

There is a registry entry to set the user that logs in. If this is reset before you log out, it can "hide" your tracks.

The profile tells me this is not through the network. However, you can log into a machine via RAS. It is just a matter of mapping to the machine, just like you do through a full-time network connection.

Best bet to track it is to set up a security policy that tracks who logs in. However, he could potentially find this out if he was looking. If you want to do this, you probably do not want to announce it.

As far as email, it is unlikely that he is getting into your email, unless he is messing with security on the Exchange Server. If he really wanted to see your email, he could change your password and log in, but it is likely that you would catch him with this.

The registry can be hacked externally, so it is more likely that the logon is designed to either make you worry or to play practical jokes on you.

I would personally go to him directly and confront him about it. He will probably deny it, but if you do not reveal how you know, you will turn the power play around, as he will wonder how you knew. It might also be best to mention this with others around; the best opening is when he brings up a subject on the registry, security, etc. What ever you do, say it rather matter-of-fact.

I might also gather the security evidence first and then turn off the policy. If he breaks in again, you can be certain that he is searching for how you caughthim.

Gregory A. Beamer
MCP: +I, SE, SD, DBA

If he's making a type 3 connection/logon (can be viewed by your audit logs on the local machine) then disallow remote access to the box or take Domain Administrators out of the Administrators local group. This way, even if he does log into the box,he's got virtually no access.

Enable logging on the box. Log all access attempts (Success/Fail), Files that are modified (F), etc..etc..

Lock down your box more to make it more of a unwelcome target. Also, with the modifications you make to your logging construct you'll provide proof that he's somewhere where he's not supposed to be.

Make sure he hasn't dropped a keystroke grabber, trojan, or any user accounts with administrator or higher privledges.

Unless you have your email saved to your local box (PAB, etc..) then no. He doesn't have access to it unless he has Permissions Admin on the Exchange box. Remember, Exchange and NT are two different beasts when it comes to security.

Thanks everyone. You are all being very helpful. I was able to confirm that he has been dialing into my workstation and signing in as Administrator. The registry exported from the local system is different than the one I exported while signed onto the network. The one from the network references specific e-mails. But, I think they are actually his (titled "vacation denied" -- mine never was).

We also got an anti-virus update last friday night. My home box logs it as sent at 1:07 and my workbox says I read it at 4:14. I leave at 4:30 and did not read this e-mail before I left. When confronted with the oddness of it all he told me that we had a conversation about it before I left. Which we did not. I don't want to set any audit policiesbecause he out ranks me. He most definately has access to the Exchange Server and Remote Access to Everything. I'm just tracking access/modify dates at this point and saving them for a home disk. My workstation did not show any actual activity over the weekend but, that E-mail could have been read from the Admin box directly on the server. I figure if I go looking, he'll know because he has to have some auditing on files he knows he shouldn't be going to. I figure the next step is to give HR the heads-up. The boss is the pres and this guy is a favorite. Not sure I want to go there. I'm still looking for scripts that he he's launching to clean up after himself.

Remember too, that with access to your registry, YOUR password can also be grabbed from the Local NT box, and then cracked using L0phtcrack, or whatever.

I suggest that you change your password to something uncrackable (use ALT and a 3 or 4 digitnumber combination to generate a character which isn't usually searched. The crack will simply fail.)

Next, whatever you do, have a different password for your Email than for your NT box.

Third, this will obviously be caught, but...
Downloada demo of Black Ice (www.networkice.com) or something similar and record the hack attempts.

then subtly have it print out on an HR printer (especially a payroll one) with a header page that reads NETWORK INTRUSION DETECTED. WARNING!!!!!

HR will investigate on their own.

The first 2 are serious, the last 2 are questionable.

Kev.

This question was closed by the author