How to find out who's been using a PC overnight?
#1
Hi All,
We have a PC in the office that runs a backup overnight. It takes about 2 hours to complete. We have stickers on the PC saying not to switch off. Problem is that about 3 times a week the user comes back in the morning to find it in the Ctrl-Alt-Del screen (WinNT sp4) and the backup has failed. It looks like someone is doing something on the PC and re-starting it before the back has completed. I've checked the Event Viewer, but it does not give any info.
We will lock the workstation now (somthing we should have done before ), but what I want to know is who is using it and what are they doing.
Can anyone recomend a keylogger or other monitoring device that we can use to find out what's going on?
Cheers
[Edited by Nimbus - 7/21/2003 11:34:08 AM]
We have a PC in the office that runs a backup overnight. It takes about 2 hours to complete. We have stickers on the PC saying not to switch off. Problem is that about 3 times a week the user comes back in the morning to find it in the Ctrl-Alt-Del screen (WinNT sp4) and the backup has failed. It looks like someone is doing something on the PC and re-starting it before the back has completed. I've checked the Event Viewer, but it does not give any info.
We will lock the workstation now (somthing we should have done before ), but what I want to know is who is using it and what are they doing.
Can anyone recomend a keylogger or other monitoring device that we can use to find out what's going on?
Cheers
[Edited by Nimbus - 7/21/2003 11:34:08 AM]
#4
Thanks Jack,
I've been doing a bit of searching and downloaded a couple of trail software key loggers and screen loggers. I'll try these out first.
For the one in the link, can't you just unplug it??
I've been doing a bit of searching and downloaded a couple of trail software key loggers and screen loggers. I'll try these out first.
For the one in the link, can't you just unplug it??
#5
Scooby Regular
Join Date: Sep 2002
Location: Essexville
Posts: 4,391
Likes: 0
Received 0 Likes
on
0 Posts
nimbus, you sure the computer aint set for windows log-in screensaver.
ie the computer locking after say 30 mins or so???
if not, you should enable this, as we work in a shared office, and its easy to leave, and forget about locking the pc.
look the internet history, as chances are its prob the cleaner surfing or something!!!
BB
ie the computer locking after say 30 mins or so???
if not, you should enable this, as we work in a shared office, and its easy to leave, and forget about locking the pc.
look the internet history, as chances are its prob the cleaner surfing or something!!!
BB
#7
Jack,
Never. I've got a laptop
Good idea about the IE history. I'll take a look...
I'll check the screen saver too. But it should not affect the backup running I think.
Never. I've got a laptop
Good idea about the IE history. I'll take a look...
I'll check the screen saver too. But it should not affect the backup running I think.
Trending Topics
#8
Make sure you are solving the right problem.
Do the backup logs actually start/show an error?
Can you tell when the PC goes down/reboots?
Have you looked at the filesystem to find out if any files are modified?
I only say that because you may have a fault on the PC which is causing it to shutdown. If the BIOS automatically reboots the machine after a kernel stop, then it may be nothing to do with a malicious user.
Good luck.
Do the backup logs actually start/show an error?
Can you tell when the PC goes down/reboots?
Have you looked at the filesystem to find out if any files are modified?
I only say that because you may have a fault on the PC which is causing it to shutdown. If the BIOS automatically reboots the machine after a kernel stop, then it may be nothing to do with a malicious user.
Good luck.
Thread
Thread Starter
Forum
Replies
Last Post
Sam Witwicky
Engine Management and ECU Remapping
17
13 November 2015 10:49 AM