Viewing system history

[LukeN]

Hi,

What is the best way I can find out if any of my office computers have been accessed over the weekend?

I have noticed a few things have been moved in my office and have a business partner who will be leaving my company in January (still has office keys/logins etc - but not for long !) and fear that he has snuck in over the weekend to have a nosey at the accounts.

I have looked at the properties tab on certain key files/applications, but as they are constantly updating, the "last accessed" information is today.

Any ideas would be greatly appreciated.

 

[EricB]

go to your recent documents

 

[LukeN]

Thanks, - have tried that but it's inconclusive.

Can I see if the machine has been turned on over the weekend?**













** It's for a law suit I'm planning.

 

[EricB]

unhide hidden folders. go to

C:\Documents and Settings\yourname\Local Settings\Temp
C:\Documents and Settings\yourname\Local Settings\Temporary Internet Files

hit view, choose detail, check date created

now hit view, check date created and show in groups. those folder should tell what was done

 

[LukeN]

Many thanks!

Suspicions unfounded.

**dials locksmith anyway**

 

[Osiris]

you need 007 spy software which takes screen shots at any given interval

 

[Inaris]

You can also look at the eventlog. If you are auditing security, you will see every logon attemp. Easy to track there.
Something we do, is in our logon script, there is a history tracking element that is written out to a log every time someone logs on to any machine. Very effective in finding who and where...

Good luck

 

[Chris93]

I've heard that Desktop Detictive 2000(dd2000) is supposed to be good, that copies:
+ every webpage accessed,
+ every keystroke hit,
+ and can take colour screenshots at any different interval.
+ You can also password protect it, so it cant be read from prying eyes

You can download dd2000 for free from: Here

This should be able to help you