G oog le BadWeB | Login/out | Topics | Search | Custodians | Register | Edit Profile


Buell Forum » Quick Board » Archive through June 18, 2013 » Win7 login trackers - utilities? « Previous Next »

Author Message
Top of pagePrevious messageNext messageBottom of page Link to this message

Mikej
Posted on Tuesday, June 11, 2013 - 09:55 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

I'm using a windows 7 computer at work on a network and do not have admin rights. For the last 6 weeks or so most of my desktop shortcuts get deleted almost weekly, sometimes twice in a day, usually when I'm away from my desk but once or twice while I was nearby so I know that someone isn't doing the deletes from my physical desk. So I'm thinking either the pc has a virus of some sort, or someone is logging in remotely from elsewhere in the building and messing with me, or something else. The IT guy said it can't happen on its own.

So, does anyone know of a small utility I can load or run locally on the pc to see and track if anyone else logs in or if someone else logs on as me? Also, is there a way to see exactly when a file was deleted and by whom?

I'm not sure how long this job will last, and not sure if I'm on someone's hit list, and as such I don't want to escalate the issue right now so I'd rather just collect data if possible so I can plan my course of action/reaction if things come to that. Right now I just pencil-log the dates/times of the deletions and restore the links from a flash drive.

Thanks for any tips or helps.
I rode the M2 to work today making this posting somewhat Buell related. ; )
Top of pagePrevious messageNext messageBottom of page Link to this message

Froggy
Posted on Tuesday, June 11, 2013 - 10:03 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Actually they can delete themselves on their own. Windows 7 has a "feature" that if it detects network shortcuts that are no longer functional, they will automatically be removed. I recommend placing them in a folder on the desktop, they will be safe in there, or adding them elsewhere like the task bar or start menu.

If you like, I can help you with showing who logs into the computer, Windows does keep track of everything in the event logs.
Top of pagePrevious messageNext messageBottom of page Link to this message

Mikej
Posted on Tuesday, June 11, 2013 - 10:56 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

I'm the only one in my department that this is happening to which is why I suspected someone actively messing around.

Some of the lost shortcuts were used within an hour before their disappearance, and the shortcut links still work when I recopy them so I don't think this is being driven by some Win7 aspect (could be but I'm guessing not).

Posting this via my phone, but if you can help or if you have any help links then that would be great so I can study up from home later.

Thanks
Top of pagePrevious messageNext messageBottom of page Link to this message

Froggy
Posted on Tuesday, June 11, 2013 - 11:16 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Yea the way the icon removing works is that if the network connection is lost (either server rebooted, network outage, etc), and Windows notices it, it will just automatically remove the shortcuts. This applies only shortcuts to things that are stored on the network or another computer, not shortcuts to items on your own computer.

If you want to check the event viewer (I'm not sure what you will see without administrative rights), click start, type in Event Viewer and click on it when it pops up. On the left side, click on Windows Logs, and then Security.

The main window in the middle will show all security related events on the computer including logins, even remote ones. There will be a lot of junk in here too (the computer itself doing its own things), so you will need to carefully read the details to figure out what is going on.

Edit: The security tab is not accessible without the administrative access, but it appears the other sections are. You may be able to determine something, but I'm not sure if it will be anything useful.

(Message edited by Froggy on June 11, 2013)
Top of pagePrevious messageNext messageBottom of page Link to this message

Mikej
Posted on Tuesday, June 11, 2013 - 01:51 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Thanks for the directions. Next time the shortcuts go away I'll look in there to see what I can see.
Top of pagePrevious messageNext messageBottom of page Link to this message

Airbozo
Posted on Tuesday, June 11, 2013 - 01:54 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Do the shortcuts show up in the trash bin? You can tell the delete time there if so...
Top of pagePrevious messageNext messageBottom of page Link to this message

Mikej
Posted on Tuesday, June 11, 2013 - 05:01 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

They don't seem to show up in the Recycle Bin but I'll check the next time it happens.
Top of pagePrevious messageNext messageBottom of page Link to this message

Garyz28
Posted on Tuesday, June 11, 2013 - 08:27 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Take a look in the C:\Users folder. There will be a profile folder in there for everyone who has ever logged in. The "Date Modified" attribute will tell you the last time they were logged in.

Only Admins can access other users profiles.
Top of pagePrevious messageNext messageBottom of page Link to this message

J2blue
Posted on Monday, June 17, 2013 - 05:34 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

As a sys admin I would strongly suggest you work with your own administrator, whoever that may be. Since you don't have admin rights it is obvious someone who set the computer up does, most likely, and there is a reason why they don't want you "tracking" anything security related. Most companies will have policies that would permit them to fire you on the spot for trying what you are asking for, no questions asked. Don't take matters into your own hands, even if you don't plan to be there very long.

I'm more apt to believe, as Froggy does, that what has you concerned is the feature/flaw of cleaning up dead shortcuts that Microsloth built into Windows 7. If it's not your computer then don't get paranoid, just use it appropriately and let the chips fall where they may. There is no ghost in that machine!
« Previous Next »

Add Your Message Here
Post:
Bold text Italics Underline Create a hyperlink Insert a clipart image

Username: Posting Information:
This is a public posting area. Enter your username and password if you have an account. Otherwise, enter your full name as your username and leave the password blank. Your e-mail address is optional.
Password:
E-mail:
Options: Post as "Anonymous" (Valid reason required. Abusers will be exposed. If unsure, ask.)
Enable HTML code in message
Automatically activate URLs in message
Action:

Topics | Last Day | Tree View | Search | User List | Help/Instructions | Rules | Program Credits Administration