IT Employment

General discussion


Track Intruder Logins on Win2000 PC.

By wayne.ha ·
Log which track when a PC is unlocked?
My client is reporting that perhaps after locking (ctrl+alt+del) his PC at night it seems someone (or an application is running) which unlocks his PC. He is asking if there is some form of a log or a way to detect this. Any help would be greatly appreciated. Thanks in advance.

This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Comments

Collapse -

FIrewall Intruder Detection

by mmoody In reply to Track Intruder Logins on ...

There are a few pieces of software which should allow you to log incoming connections or (Intruders) Alot of people do port scans and with out a firewall you could be in some serious do do... Try BlackIce I believe they have a trial version. See if that helps otherwise search for Intruder Detection on a good search engine.

Hope this helps!


Collapse -

sounds like an inside job

by andrew.lawlor In reply to Track Intruder Logins on ...

An application would have no need to unlock the screen to run.

Someone quite likely has found his password (under the keyboard?). Recently found out a guy on the cleaning crew was surfing for porn after hours when machines weren't locked / logged off / shut down.

Your client might just want to change his/her password on that machine.

Collapse -

try auditing

by tlath1972 In reply to Track Intruder Logins on ...

If you are part of a active directory then put an audit policy on that computer in the OU. If its a standalone computer then set up audting in the local user policy. For help on this click start help and type in auditing. you can log sucessful and unsucessful log on attempts. Then when someone logs on then you check the event viewer to find out when and who.

Related Discussions

Related Forums