Windows Forum

Ask something
Discussion Locked

Unauthorised log ons

0 helpful
2 replies

by fiscom3

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I am auditing my logons and object access. I keeps getting security logs that have statement like SYNCHRONIZE and Read Data for the my documents folder. My hdrive is not shared out. I ran netstat and another workstation was listed as an Active Connection. I went and got one of the On site IT staff to witness it. I notice in a few minutes my screen kind of blinked. I ran the netstat command again and the workstation was no longer listed as An ACTIVE connection. The workstation was in a room secured with no one around. The workstation is running W2k. and was on with the monitor turned off. The suspect works in another building. How did he do it?

2 replies

by saihib

Is the "secure" machine running any kind of remote control software like VNC or PCAnywhere?

by fiscom3

No I am not running VNC or PCanywhere. In addition on Auditing Object access it reported the name of several files which were accessed. The local IT said he may be using some type of push pull technology to sychronize the my document folder. Also logged was access failures which listed the name of one workstation and the name of another as the username

This discussion is closed to new replies.