URGENT REQUEST FOR INFORMATION

  • Thread starter Thread starter Ian Henderson
  • Start date Start date
I

Ian Henderson

I really hope that someone can give me an easy answer to this question:

We're currently running a network solely based on Windows 2000. We're a
24-hour company, but there is only IT cover on duty between 9am and 7pm
Monday to Friday. We (the IT Department) arrived at work this morning to
discover that someone had opened one of the PCs on the call centre floor,
and removed a memory DIMM. They didn't replace the cover on the PC, which
is how we were alerted to the problem.

Obviously, we need to catch the person responsible for this theft. However,
our own network setup is hindering us in doing so, given that none of the
general users have their own network accounts - each machine has been
allocated a static account. Therefore, the only chance we're going to have
of identifying the offender is if there is any way of finding out when the
last time was that that computer was connected to the network. I'm
presuming that there's a log kept of all network connections made and
terminated, but I can't find it.

If anyone has any idea at all, please post a reply to this message. Also,
it would be helpful to me if they could also send a reply to my direct
address ([email protected]).

TIA

Ian Henderson
Database Developer
The EssentiaGroup
 
If PCs obtain IP information via DHCP, you may find some
useful info there (lease times etc).

Failing that, if you audit logon events, you should search
for logon events in the Security event logs that relate to
that machine/user.

HTH,
Neil
 
When who ever logge in there profile would have been
created updated check dates time attrib on .dat etc.

G
 
Back
Top