Author |
Message |
Mikej
| Posted on Tuesday, June 11, 2013 - 09:55 am: |
|
I'm using a windows 7 computer at work on a network and do not have admin rights. For the last 6 weeks or so most of my desktop shortcuts get deleted almost weekly, sometimes twice in a day, usually when I'm away from my desk but once or twice while I was nearby so I know that someone isn't doing the deletes from my physical desk. So I'm thinking either the pc has a virus of some sort, or someone is logging in remotely from elsewhere in the building and messing with me, or something else. The IT guy said it can't happen on its own. So, does anyone know of a small utility I can load or run locally on the pc to see and track if anyone else logs in or if someone else logs on as me? Also, is there a way to see exactly when a file was deleted and by whom? I'm not sure how long this job will last, and not sure if I'm on someone's hit list, and as such I don't want to escalate the issue right now so I'd rather just collect data if possible so I can plan my course of action/reaction if things come to that. Right now I just pencil-log the dates/times of the deletions and restore the links from a flash drive. Thanks for any tips or helps. I rode the M2 to work today making this posting somewhat Buell related. |
Froggy
| Posted on Tuesday, June 11, 2013 - 10:03 am: |
|
Actually they can delete themselves on their own. Windows 7 has a "feature" that if it detects network shortcuts that are no longer functional, they will automatically be removed. I recommend placing them in a folder on the desktop, they will be safe in there, or adding them elsewhere like the task bar or start menu. If you like, I can help you with showing who logs into the computer, Windows does keep track of everything in the event logs. |
Mikej
| Posted on Tuesday, June 11, 2013 - 10:56 am: |
|
I'm the only one in my department that this is happening to which is why I suspected someone actively messing around. Some of the lost shortcuts were used within an hour before their disappearance, and the shortcut links still work when I recopy them so I don't think this is being driven by some Win7 aspect (could be but I'm guessing not). Posting this via my phone, but if you can help or if you have any help links then that would be great so I can study up from home later. Thanks |
Froggy
| Posted on Tuesday, June 11, 2013 - 11:16 am: |
|
Yea the way the icon removing works is that if the network connection is lost (either server rebooted, network outage, etc), and Windows notices it, it will just automatically remove the shortcuts. This applies only shortcuts to things that are stored on the network or another computer, not shortcuts to items on your own computer. If you want to check the event viewer (I'm not sure what you will see without administrative rights), click start, type in Event Viewer and click on it when it pops up. On the left side, click on Windows Logs, and then Security. The main window in the middle will show all security related events on the computer including logins, even remote ones. There will be a lot of junk in here too (the computer itself doing its own things), so you will need to carefully read the details to figure out what is going on. Edit: The security tab is not accessible without the administrative access, but it appears the other sections are. You may be able to determine something, but I'm not sure if it will be anything useful. (Message edited by Froggy on June 11, 2013) |
Mikej
| Posted on Tuesday, June 11, 2013 - 01:51 pm: |
|
Thanks for the directions. Next time the shortcuts go away I'll look in there to see what I can see. |
Airbozo
| Posted on Tuesday, June 11, 2013 - 01:54 pm: |
|
Do the shortcuts show up in the trash bin? You can tell the delete time there if so... |
Mikej
| Posted on Tuesday, June 11, 2013 - 05:01 pm: |
|
They don't seem to show up in the Recycle Bin but I'll check the next time it happens. |
Garyz28
| Posted on Tuesday, June 11, 2013 - 08:27 pm: |
|
Take a look in the C:\Users folder. There will be a profile folder in there for everyone who has ever logged in. The "Date Modified" attribute will tell you the last time they were logged in. Only Admins can access other users profiles. |
J2blue
| Posted on Monday, June 17, 2013 - 05:34 pm: |
|
As a sys admin I would strongly suggest you work with your own administrator, whoever that may be. Since you don't have admin rights it is obvious someone who set the computer up does, most likely, and there is a reason why they don't want you "tracking" anything security related. Most companies will have policies that would permit them to fire you on the spot for trying what you are asking for, no questions asked. Don't take matters into your own hands, even if you don't plan to be there very long. I'm more apt to believe, as Froggy does, that what has you concerned is the feature/flaw of cleaning up dead shortcuts that Microsloth built into Windows 7. If it's not your computer then don't get paranoid, just use it appropriately and let the chips fall where they may. There is no ghost in that machine! |
|