Monitoring user access.

[Spurklie]

I suspect someone may have gone on to my computer in my user name while I was
not at home. (They knew my password, which I have now changed). Is there a
log within xp sp2 with details of who has logged in and when?

 

[Vinson]

You can browse the event logs.

Click Start>>Control Panel>>Administrative Tools>> Event Viewer

Click the security tab, and look at those events.

Vinson

 

[Spurklie]

Thanks for that. There is information listed under the Application and System
tabs which do show events happening at the time I wasn't there, but there is
nothing under the security tab. Does this mean the computer thinks nothing
untoward as happened as my log is the computer administrator, or is there
something not enabled which should be recording security events such as users
logging on? Also can events be occurring and recorded even though the
computer isn't turned on? Many thanks for any help on this.

 

[Nepatsfan]

I suspect someone may have gone on to my computer in my user name while I was
not at home. (They knew my password, which I have now changed). Is there a
log within xp sp2 with details of who has logged in and when?

If you're running Windows XP Home Edition go to Start -> Control Panel ->
Administrative Tools and open up the Event Viewer. In the left hand column,
click on Security. In the right hand pane, click on the User column. Scroll down
to your user name and look for successful Logon/Logoff events.

If you're running XP Professional, you'll have to enable auditing of logon
events. You can do that through the local
security policy. Once this is done you'll be able to view future logon events in
Event Viewer using the procedure
outlined above.

Go to Start -> Control Panel -> Administrative Tools and double click on Local
Security Policy.
In the Local Security Policy editor, navigate to this policy.

Security Settings\Local Policies\Audit Policy

In the right hand pane, right click on Audit logon events.
Select Properties from the menu.
Put a check mark in the box next to both Success and Failure.
Click OK.

Keep in mind that if you're running XP Professional, enabling auditing of logon
events at this time will not allow you to view any unauthorized activity that
happened in the past. It will start recording future logon events.

For more info, take a look at these articles.

Audit Policy Settings
http://www.microsoft.com/technet/security/prodtech/windowsxp/secwinxp/xpsgch03.mspx#ETE

How To Enable Security Auditing in Windows XP Pro
http://netsecurity.about.com/cs/tutorials/ht/ht040503.htm

Good luck

Nepatsfan