Find The User

check the logs and internet cache

edit - if you install a good internet traffic tracking program it will do this for you in future as the bets ones ID the user name of the person logged on as they visit every web site. Some log all traffic, some log all traffic not on the white list, and most will block traffic to those on the black list.

Depend on the application and the users intention you have several options.

First if you can re-review the complaint. The complaint usually gives the file name from the download, time stamp, IP address, application used to get it, etc.

1. Even in DHCP, and depending on how detailed the IP info was and how your network is configured, you can still find the machine, because the computer will keep its IP address as long as it can contact the DHCP server. So a desktop will stay pretty static unless they ask for a new lease or it gets moved. Laptops frequently change.

2. Is this something the user would install for/at work? Theres an application "belarc advisor" which will do a system audit of installed programs. Which will make it easier to find the rouge program. In the same vain, you will also want to look for programs such as utorrent, edonkey, limewire etc. Which are torrent download programs. And those users are either your culprit or could download things also and will need to be dealt with.

3. If the user could be sharing the file in the office. Do a search for the file name on any network drives.

4. Ask if anyone has a copy of that program you can borrow, you might have to get someone "non-IT" that you can trust to do this. Unless they know about the complaint and if there is a punishment looming people are pretty willing to share their "free" software, and that can expedite your search.

6. If you allow users to bring their personal machines to the office, this can create a problem. It will make it harder to track depending on your companies policy, and if there is very little policy you may have to implement some as far as who/ what is allow to access the company network. So if they bring the machine to work and its accessing the company network they are allowing the company to audit the machine.

7. Contact your ISP or review your logs. The person who downloaded the program probably hasn't stopped downloading things. Get a run down of the top bandwidth users and see why they are using so much.

If they are really smart, they have stopped. If they are kinda smart they will wait before they do it again, and it becomes a waiting game. But you should stay vigilant as if not them, someone else will be downloading.

Just so you know if you only receive one complaint don't worry to much. Its usually just a warning shot. They are letting you know, that they know and want you to stop. But doesn't not mean you should take the issue lightly. And good luck on the search.

If the software is installed on a PC at present. This software will help seek it out.

http://www.pxserver.com/WinAudit.htm

If he has a domain winaudit could be deployed via a GP. (and with 50+ machines i would hope so) so he could quickly get the info from those.

But what about somebody's personal machine on the network? I don't see any options for it to scan remote or networked machines, unless you physically get on the machine and run it. Or is there a method I'm missing here?

This is where you should have a domain controller in place. Save the winaudit.exe to a network share location. Then from there you can deploy a group policy to run the program.

So for a simple login script:

"@echo off

\\SERVER\path_to\WinAudit.exe /r=gos /o=CSV f=\\SERVER\path_to\Audit_saves\

exit"

(See the help page for all argument options: http://www.pxserver.com/WinAudit/hlp_command_line.html)

If you do not have a domain controller, there is no easy way to run that program across all the machines.