S
Sid Joyner
Hi All:
I administer a Windows XP computer for my parents from across the U.S. using
Remote Desktop. It works rather well and I'm able to log on once or twice a
week to check that firewall, antivirus, etc are working well. I'm the only
user with computer administrator rights; my parents user login is configured
as a limited user. The Guest acount is also turned on for visitors to my
parents home.
I was logged on remotely to this computer last week and opened an IE browser
which has MSN as my home page with passport signin. I was horrified to see a
different passport than mine highlighted as the default passport waiting for
a password. The passport - "(e-mail address removed)" - was a name I had never
seen before and I really have no idea who could have been on under my login
for this to happen. My parents don't even know how to log in under my
user/pass. I have to believe that someone hacked remotely into the computer
using my user login, opened MSN from IE and left this passport behind.
My question: is there any administration logging mechanism within XP to log
all users connecting via Remote Desktop and the IP address associated with
that log in. And if not (which would be shocking to me), how could I do this
to make sure there is a record of all remote logins, the user name used, and
the IP from which the connection occurs?
FYI. I use Norton Systemworks 2005 for firewall and antivirus on the
computer. There's also a Netgear router the computer is connected to with
3389 forwarded.
Thanks for any help.
I administer a Windows XP computer for my parents from across the U.S. using
Remote Desktop. It works rather well and I'm able to log on once or twice a
week to check that firewall, antivirus, etc are working well. I'm the only
user with computer administrator rights; my parents user login is configured
as a limited user. The Guest acount is also turned on for visitors to my
parents home.
I was logged on remotely to this computer last week and opened an IE browser
which has MSN as my home page with passport signin. I was horrified to see a
different passport than mine highlighted as the default passport waiting for
a password. The passport - "(e-mail address removed)" - was a name I had never
seen before and I really have no idea who could have been on under my login
for this to happen. My parents don't even know how to log in under my
user/pass. I have to believe that someone hacked remotely into the computer
using my user login, opened MSN from IE and left this passport behind.
My question: is there any administration logging mechanism within XP to log
all users connecting via Remote Desktop and the IP address associated with
that log in. And if not (which would be shocking to me), how could I do this
to make sure there is a record of all remote logins, the user name used, and
the IP from which the connection occurs?
FYI. I use Norton Systemworks 2005 for firewall and antivirus on the
computer. There's also a Netgear router the computer is connected to with
3389 forwarded.
Thanks for any help.