Hi All,

We have a PC in the office that runs a backup overnight. It takes about 2 hours to complete. We have stickers on the PC saying not to switch off. Problem is that about 3 times a week the user comes back in the morning to find it in the Ctrl-Alt-Del screen (WinNT sp4) and the backup has failed. It looks like someone is doing something on the PC and re-starting it before the back has completed. I've checked the Event Viewer, but it does not give any info.

We will lock the workstation now (somthing we should have done before :o), but what I want to know is who is using it and what are they doing.

Can anyone recomend a keylogger or other monitoring device that we can use to find out what's going on?

Cheers


[Edited by Nimbus - 7/21/2003 11:34:08 AM]

put in a webcam and see who is doing it!!!

This'll do the job http://www.keyghost-uk.com/

Thanks Jack,

I've been doing a bit of searching and downloaded a couple of trail software key loggers and screen loggers. I'll try these out first.

For the one in the link, can't you just unplug it??

nimbus, you sure the computer aint set for windows log-in screensaver.
ie the computer locking after say 30 mins or so???

if not, you should enable this, as we work in a shared office, and its easy to leave, and forget about locking the pc.

look the internet history, as chances are its prob the cleaner surfing or something!!!

BB:)

Nimbus, when was the last time you checked your keyboard lead? Just checked mine now by the way :D

Jack,

Never. I've got a laptop :p


Good idea about the IE history. I'll take a look...

I'll check the screen saver too. But it should not affect the backup running I think.

Make sure you are solving the right problem.

Do the backup logs actually start/show an error?
Can you tell when the PC goes down/reboots?
Have you looked at the filesystem to find out if any files are modified?

I only say that because you may have a fault on the PC which is causing it to shutdown. If the BIOS automatically reboots the machine after a kernel stop, then it may be nothing to do with a malicious user.
Good luck.