Desktop

Ask something
Question Locked

Windows administrator password logging

0 helpful
7 replies

by john

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi,
got a bit of a curly question, might fall under computer forensics.
I do IT for a small primary school. I am running several PCs which boot up and automatically load an application selection screen where the student can choose which application they would like.
Somewhere along the line the administrator password for windows XP on one of the computers has been changed from what I set to '123'. As crazy as this sounds could this have been done by the system?? or has it been done by a clever child who has found a way around the restrictions I have on the computer?? If so is there a log file or something that I could look at to find some trace of when it was done??

7 replies

by john

The password hint was turned on. It said "123" so thats the first thing I tried. Thats partly the reason that I know it wasnt me that changed it because I sure wouldnt put the exact password in the hint box!!

by oh smeg

Yes you can thank at least one of the students for this.

As to have they left tracks well most certainly but first you need to know how they did it to find out what they have done. I've seen things like this done quite a lot by [b]Little Angles[/b] who can do no wrong in their parents eyes so I just fix up the thing and point out the dangers of not using Secure Passwords and never to enter a password in front of children.

Col

by john

Yeah I thought as much. Since posting the original question a suspect has been pointed out to me!!! Cheerz for your reply.

by oh smeg

OH and also as they say in the movie [b]Spaceballs[/b] a password of 1234 is what an Idiot would use on their luggage when they go on Holidays. ;)

Col

by rob miners

628 and 576 for date and time that this happened. It could even be a staff member checking to see if you are on the ball.

Edit to add and edited again to provide the link.

You should go around all PC's and change the passwords, BIOS entry passwords to.

http://support.microsoft.com/kb/174074

This discussion is closed to new replies.