RE: WinXP Login Logs

[Giraldo Alonso Suárez <giraldo.alonso () cigb edu cu>]

Hi,
In System Properties Windows -> Advanced -> User Profiles Settings appear the profiles stored on the computer with date 
of modification (last date of logging).



-----Original Message-----
From: Bob Kurth [mailto:Bob.Kurth () fcserv com] 
Sent: Friday, January 07, 2005 3:58 PM
To: security-basics () securityfocus com
Subject: RE: WinXP Login Logs

Bruno et al:

It is very likely that the janitorial staff are using your PC's/network
during the night.  It would seem unusual that they could log on to the
workstations to use them, especially since you are using WinXP.  If you
can pinpoint the actual workstations they are using, you may want to do
a walk around before or after normal business hours.  Seems to me it is
highly likely that some end user has pulled out the Post-It notes to
help them remember their password.  All other responses aside, this is
the simplest explanation for what's happened.

Robert Kurth, CISSP

-----Original Message-----
From: Bruno Guedes Souto [mailto:brunoguedes () gmail com] 
Sent: Thursday, January 06, 2005 9:21 PM
To: security-basics () securityfocus com
Subject: Re: WinXP Login Logs

Thanks for all the help guys. Tomorrow I'll see.The computers don't
have any kind of "secret" information or something like that. I think
there are just janitors or something like that "curious" about. I
don't know if they have logged in, I just assumed it. The room gets
locked during night but there are several ways to get a key. So i just
wanna to discover the reason and what is happening. About the sudden
"power loss" could i test it? I mean, if I pull the plug off the wall,
wait a few minutes and then put it back again ,if such mechanism is
there would the pc boot up?

Regards

Bruno Souto


On Fri, 7 Jan 2005 08:27:51 +1000, Mitch Pope <mitch () bigbridge com au>
wrote:
> Turn on "Display last user" in the local security policy.  That way
when you
> press control+alt+del after bootup it will show the last username in
the
> login username box.
>
> Another thing to be aware of is computers configured to startup on
detection
> of fresh power.  So if power drops out through the night and then
comes back
> a few minutes later the computers may start up by themselves.  But
that
> however does not explain them being used.
>
> Mitch
>
> ----- Original Message -----
> From: "Bruno Guedes Souto" <brunoguedes () gmail com>
> To: <security-basics () securityfocus com>
> Sent: Thursday, January 06, 2005 10:45 PM
> Subject: WinXP Login Logs
>
> > Suddenly here in my work, some PCs are being turned on by "ghosts"
> > during night/clean periods and they are being used! How can I know
the
> > last person who logged in? Are there some kind of login logs in win
> > xp?
> >
> > Regards
> >
> > Bruno Souto