Question

Locked

Windows administrator password logging

By john ·
Hi,
got a bit of a curly question, might fall under computer forensics.
I do IT for a small primary school. I am running several PCs which boot up and automatically load an application selection screen where the student can choose which application they would like.
Somewhere along the line the administrator password for windows XP on one of the computers has been changed from what I set to '123'. As crazy as this sounds could this have been done by the system?? or has it been done by a clever child who has found a way around the restrictions I have on the computer?? If so is there a log file or something that I could look at to find some trace of when it was done??

This conversation is currently closed to new comments.

6 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Answers

Collapse -

Mmm - if it's been changed, how do you know what it now is?

by OldER Mycroft In reply to Windows administrator pas ...

That would seem to be a contradiction in terms.

Collapse -

Windows administrator password logging

by john In reply to Mmm - if it's been change ...

The password hint was turned on. It said "123" so thats the first thing I tried. Thats partly the reason that I know it wasnt me that changed it because I sure wouldnt put the exact password in the hint box!!

Collapse -

RE : or has it been done by a clever child who has found a way around th

by OH Smeg In reply to Windows administrator pas ...

Yes you can thank at least one of the students for this.

As to have they left tracks well most certainly but first you need to know how they did it to find out what they have done. I've seen things like this done quite a lot by Little Angles who can do no wrong in their parents eyes so I just fix up the thing and point out the dangers of not using Secure Passwords and never to enter a password in front of children.

Col

Collapse -

RE : or has it been done by a clever child who has found a way around th

by john In reply to RE : [i]or has it been do ...

Yeah I thought as much. Since posting the original question a suspect has been pointed out to me!!! Cheerz for your reply.

Collapse -

Your Welcome

by OH Smeg In reply to RE : or has it been done ...

OH and also as they say in the movie Spaceballs a password of 1234 is what an Idiot would use on their luggage when they go on Holidays.

Col

Collapse -

Check event ID

by Jacky Howe In reply to Windows administrator pas ...

628 and 576 for date and time that this happened. It could even be a staff member checking to see if you are on the ball.

Edit to add and edited again to provide the link.

You should go around all PC's and change the passwords, BIOS entry passwords to.


http://support.microsoft.com/kb/174074

Back to Desktop Forum
6 total posts (Page 1 of 1)  

Related Discussions

Related Forums