Logging your activities on a computer?

Is there something that logs all of a user's activities on a computer (which files they have opened up, which programs they have used)? If so,
1) can I, having administrator privileges, enable/disable this logging for particular users?
2) how can I view these logs?

 

Re: Logging you activities on a computer?

There is nothing built into the operating system. Third party tools can be purchased for this purpose. Most of the references to "keyloggers" on this forum are how to keep them OFF your system.

 

Re: Logging you activities on a computer?

As 'Genady Prishnikov' statet, there are only third party applications which acomplish this task. But as they have a bad fame, i think discussions of them are strictly forbidden on Wilders. Using Google will give you some results.

 

Re: Logging you activities on a computer?

Sorry, mis-understood the OP's question. Carry on. Pete

 

Re: Logging you activities on a computer?

So, just to be clear, Windows XP does NOT in any way log events on your computer? That's all I want to know.

 

Re: Logging you activities on a computer?

It logs a lot of events on your computer. But as far as privacy goes, there is no keystroke logger. My main concern of what the XP itself keeps are the web pages you have browsed in the index.dat files and the cache. But keystrokes? No.

-------------

 

Re: Logging you activities on a computer?

Check out this thread on IE7:

http://www.dslreports.com/forum/remark,17438684

regards,

-rich

 

Re: Logging you activities on a computer?

I don't know if you mean keystrokes literally but if you do I am not interested in that. I am only interested in
1) the files that have been accessed
2) the programs that have been run
Does Windows XP log these or not?

 

Re: Logging you activities on a computer?

HI!

Actually, I work to prevent key logging and other security issues. So, if you are interested in the other side (how to protect yourself) then it's a good idea to install firewall and anti-virus software. Most antivirus softwares provides their users with anti-keylogging feature as the idea is the same - find and block some certain pattern.

 

Re: Logging you activities on a computer?

Anti-Virus software is notoriously bad for detecting keyloggers.

By the way, welcome to Wilders! Lots of nice people here.

 

Re: Logging you activities on a computer?

silly wabbit
of course you can, this is after all an OS for businesses
and employee privacy is a modern oxymoron

of course auditing is also a tin foil wearing paranoid's wet dream too

Define or modify auditing policy settings for an event category

for a local computer
Start > Run > (type) gpedit.msc > expand Windows Settings > expand Security Settings > expand Local Policies > select Audit Policy > DClick Audit Object access > check successful, failure or both
then backtrack to to Windows Settings > Security Settings > Local Policies > Security Options > DClick Audit the access of global system objects > Disabled > Restart to take effect


then
Setup Auditing on a File or Folder
(must be NTFS)
Windows Explorer > Navigate to File or Folder > Rclick > Properties > Security Tab > Advanced > Audit Tab > Add > type name of user\group or select from list > OK > Under access select successful, failure or both or neither for:
Traverse Folder / Execute File
List Folder / Read Data
Read Attributes
Read Extended Attributes
Create File / Write Data
Create Folders / Append Data
Write Attributes
Write Extended Attributes
Delete Subfolders and Files
Delete
Read Permissions
Change Permissions
Take Ownership

set inheritance
of course for an ap its the exe file thats audited
results are in the Eventviewer (eventvwr.msc) security log and they are listed by event ID numbers
you DClick the event and...

http://i17.tinypic.com/2ptncra.jpg

I just audited myself opening Photoshop



keep in mind that too much auditing can lead to massive log files and even poor performance, you can limit a log size to a given value when it will then start to be overwritten
in Event Viewer > Rclick event category (ie security) > Properties > set max log size > check overwrite as needed, there are other options

see link above for domain level procedures to enable auditing

a few more links

Who's afraid of auditing? Understanding Windows logs @ searchsecurity
Understanding NTFS Permissions @ WindowsSecurity
Security Event Descriptions @ Microsoft
Event IDs 560 and 562 appear many times in the security event log (Must read)
How to view and manage event logs in Event Viewer in Windows XP (including searching and using filters)
Apply or modify auditing policy settings for a local file or folder

 

Re: Logging you activities on a computer?

Hmm.. thank you Ice_Czar for pointing me in the right direction, but it's not working for me:

1) When I try to follow instructions in your first link, I open Administrative Tools from Control Panel but I do not see "Local Security Settings". I am an Administrator for my computer.

2) When I try to follow your instructions below that link and I try to run "gpedit.msc", it tells me Windows cannot find gpedit.msc.

Could the problem be that I have Windows XP Home Edition rather than Professional? Does this make a difference?

 

Re: Logging you activities on a computer?

http://support.microsoft.com/kb/307882/

See "How to Start the Group Policy Editor" section.

Is your computer using NTFS? Pete

* Never mind - it is only for XP Pro: http://support.microsoft.com/kb/307882/#appliesto & http://www.xptuneup.com/xptuneup_qos.htm

 

Re: Logging you activities on a computer?

yup XP Home doesnt have Group Policy Edit

and if you where to hook it up to a domain that had an administrative XP Pro or W2K computer (where you could enable auditing via NTFS on your box?), youd also have to view those event logs on the XP pro \ W2K administrative box?

you might be able to forward the logs from that box back to yours, but it would mean yet another computer on at least intermittently? Not sure if there would be some way to get the NTFS security logs and view them once its been set on your box. They would be there in the NTFS filesystem I think? Need to research see if an XP Home box can be enabled to audit objects on a LAN at all. Or if like Dynamic Disks there is a hack to enable it.

 

Part One of the workaround, joining a domain (need one friend with pro)

http://vowe.net/archives/001639.html

http://www.x-setup.net/downloads/home.asp

now I think that if you've actually joined the domain all its default policies will apply and the auditing its been set to do will also apply, in which case its a matter of extracting the security logs in isolation from the domain, which would be a NTFS permissions issue, stubborn permissions can be defeated with an ap called SuperCALCS which youd need to hunt up. And the last step of course would be to view them.

Of course here is where its all too much
and you go find a third party software solution.
(which may be doing the same thing and using NTFS to audit)

here you have alot of the gpedit security functionality but I dont see audit objects
http://www.dougknox.com/xp/utils/xp_securityconsole.htm

 

For obvious reasons i won't post direct links but i been logging my units for years with JTHabcKeylogger which screenshots at timed intervals, Tiny Key keeps my reports accurate and at which time i typed or accessed IE or Windows Explorer. This is strickly for my own research and is served me well.
Google is your source for tools & utilities to help you keep track of your own actions. I still have someplace a Process Monitor that logs the exact time i entered a folder/file/or typed a review. Saves a ton of manual typing.