Logging your activities on a computer?

Discussion in 'privacy general' started by HighCommander4, Dec 9, 2006.

Thread Status:
Not open for further replies.
  1. HighCommander4

    HighCommander4 Registered Member

    Joined:
    Dec 9, 2006
    Posts:
    4
    Is there something that logs all of a user's activities on a computer (which files they have opened up, which programs they have used)? If so,
    1) can I, having administrator privileges, enable/disable this logging for particular users?
    2) how can I view these logs?
     
  2. Genady Prishnikov

    Genady Prishnikov Registered Member

    Joined:
    Mar 9, 2006
    Posts:
    350
    Re: Logging you activities on a computer?

    There is nothing built into the operating system. Third party tools can be purchased for this purpose. Most of the references to "keyloggers" on this forum are how to keep them OFF your system.
     
  3. Tommy

    Tommy Registered Member

    Joined:
    Dec 24, 2002
    Posts:
    1,169
    Location:
    Buenos Aires - Munic
    Re: Logging you activities on a computer?

    As 'Genady Prishnikov' statet, there are only third party applications which acomplish this task. But as they have a bad fame, i think discussions of them are strictly forbidden on Wilders. Using Google will give you some results.
     
    Last edited: Dec 10, 2006
  4. spy1

    spy1 Registered Member

    Joined:
    Dec 29, 2002
    Posts:
    3,139
    Location:
    Clover, SC
    Re: Logging you activities on a computer?

    Sorry, mis-understood the OP's question. Carry on. Pete
     
    Last edited: Dec 10, 2006
  5. HighCommander4

    HighCommander4 Registered Member

    Joined:
    Dec 9, 2006
    Posts:
    4
    Re: Logging you activities on a computer?

    So, just to be clear, Windows XP does NOT in any way log events on your computer? That's all I want to know.
     
  6. Genady Prishnikov

    Genady Prishnikov Registered Member

    Joined:
    Mar 9, 2006
    Posts:
    350
    Re: Logging you activities on a computer?

    It logs a lot of events on your computer. But as far as privacy goes, there is no keystroke logger. My main concern of what the XP itself keeps are the web pages you have browsed in the index.dat files and the cache. But keystrokes? No.

    -------------
     
  7. Rmus

    Rmus Exploit Analyst

    Joined:
    Mar 16, 2005
    Posts:
    3,943
    Location:
    California
    Re: Logging you activities on a computer?

    Check out this thread on IE7:

    http://www.dslreports.com/forum/remark,17438684

    regards,

    -rich
     
  8. HighCommander4

    HighCommander4 Registered Member

    Joined:
    Dec 9, 2006
    Posts:
    4
    Re: Logging you activities on a computer?

    I don't know if you mean keystrokes literally but if you do I am not interested in that. I am only interested in
    1) the files that have been accessed
    2) the programs that have been run
    Does Windows XP log these or not?
     
  9. Sam Miller

    Sam Miller Registered Member

    Joined:
    Dec 19, 2006
    Posts:
    22
    Re: Logging you activities on a computer?

    HI!

    Actually, I work to prevent key logging and other security issues. So, if you are interested in the other side (how to protect yourself) then it's a good idea to install firewall and anti-virus software. Most antivirus softwares provides their users with anti-keylogging feature as the idea is the same - find and block some certain pattern.

     
  10. Genady Prishnikov

    Genady Prishnikov Registered Member

    Joined:
    Mar 9, 2006
    Posts:
    350
    Re: Logging you activities on a computer?

    Anti-Virus software is notoriously bad for detecting keyloggers.

    By the way, welcome to Wilders! Lots of nice people here.
     
  11. Ice_Czar

    Ice_Czar Registered Member

    Joined:
    May 21, 2002
    Posts:
    696
    Location:
    Boulder Colorado
    Re: Logging you activities on a computer?

    silly wabbit :-*
    of course you can, this is after all an OS for businesses
    and employee privacy is a modern oxymoron :rolleyes:

    of course auditing is also a tin foil wearing paranoid's wet dream too :p

    Define or modify auditing policy settings for an event category

    for a local computer
    Start > Run > (type) gpedit.msc > expand Windows Settings > expand Security Settings > expand Local Policies > select Audit Policy > DClick Audit Object access > check successful, failure or both
    then backtrack to to Windows Settings > Security Settings > Local Policies > Security Options > DClick Audit the access of global system objects > Disabled > Restart to take effect


    then
    Setup Auditing on a File or Folder
    (must be NTFS)
    Windows Explorer > Navigate to File or Folder > Rclick > Properties > Security Tab > Advanced > Audit Tab > Add > type name of user\group or select from list > OK > Under access select successful, failure or both or neither for:
    Traverse Folder / Execute File
    List Folder / Read Data
    Read Attributes
    Read Extended Attributes
    Create File / Write Data
    Create Folders / Append Data
    Write Attributes
    Write Extended Attributes
    Delete Subfolders and Files
    Delete
    Read Permissions
    Change Permissions
    Take Ownership

    set inheritance
    of course for an ap its the exe file thats audited
    results are in the Eventviewer (eventvwr.msc) security log and they are listed by event ID numbers
    you DClick the event and...

    http://i17.tinypic.com/2ptncra.jpg

    I just audited myself opening Photoshop



    keep in mind that too much auditing can lead to massive log files and even poor performance, you can limit a log size to a given value when it will then start to be overwritten
    in Event Viewer > Rclick event category (ie security) > Properties > set max log size > check overwrite as needed, there are other options

    see link above for domain level procedures to enable auditing

    a few more links

    Who's afraid of auditing? Understanding Windows logs @ searchsecurity
    Understanding NTFS Permissions @ WindowsSecurity
    Security Event Descriptions @ Microsoft
    Event IDs 560 and 562 appear many times in the security event log (Must read)
    How to view and manage event logs in Event Viewer in Windows XP (including searching and using filters)
    Apply or modify auditing policy settings for a local file or folder
     
    Last edited: Dec 22, 2006
  12. HighCommander4

    HighCommander4 Registered Member

    Joined:
    Dec 9, 2006
    Posts:
    4
    Re: Logging you activities on a computer?

    Hmm.. thank you Ice_Czar for pointing me in the right direction, but it's not working for me:

    1) When I try to follow instructions in your first link, I open Administrative Tools from Control Panel but I do not see "Local Security Settings". I am an Administrator for my computer.

    2) When I try to follow your instructions below that link and I try to run "gpedit.msc", it tells me Windows cannot find gpedit.msc.

    Could the problem be that I have Windows XP Home Edition rather than Professional? Does this make a difference?
     
  13. spy1

    spy1 Registered Member

    Joined:
    Dec 29, 2002
    Posts:
    3,139
    Location:
    Clover, SC
  14. Ice_Czar

    Ice_Czar Registered Member

    Joined:
    May 21, 2002
    Posts:
    696
    Location:
    Boulder Colorado
    Re: Logging you activities on a computer?

    yup XP Home doesnt have Group Policy Edit

    and if you where to hook it up to a domain that had an administrative XP Pro or W2K computer (where you could enable auditing via NTFS on your box?), youd also have to view those event logs on the XP pro \ W2K administrative box?

    you might be able to forward the logs from that box back to yours, but it would mean yet another computer on at least intermittently? Not sure if there would be some way to get the NTFS security logs and view them once its been set on your box. They would be there in the NTFS filesystem I think? Need to research see if an XP Home box can be enabled to audit objects on a LAN at all. Or if like Dynamic Disks there is a hack to enable it.
     
    Last edited: Dec 23, 2006
  15. Ice_Czar

    Ice_Czar Registered Member

    Joined:
    May 21, 2002
    Posts:
    696
    Location:
    Boulder Colorado
    Part One of the workaround, joining a domain (need one friend with pro)

    http://vowe.net/archives/001639.html

    http://www.x-setup.net/downloads/home.asp

    now I think that if you've actually joined the domain all its default policies will apply and the auditing its been set to do will also apply, in which case its a matter of extracting the security logs in isolation from the domain, which would be a NTFS permissions issue, stubborn permissions can be defeated with an ap called SuperCALCS which youd need to hunt up. And the last step of course would be to view them.

    Of course here is where its all too much
    and you go find a third party software solution. :p
    (which may be doing the same thing and using NTFS to audit)

    here you have alot of the gpedit security functionality but I dont see audit objects
    http://www.dougknox.com/xp/utils/xp_securityconsole.htm
     
    Last edited: Dec 23, 2006
  16. EASTER.2010

    EASTER.2010 Guest

    For obvious reasons i won't post direct links but i been logging my units for years with JTHabcKeylogger which screenshots at timed intervals, Tiny Key keeps my reports accurate and at which time i typed or accessed IE or Windows Explorer. This is strickly for my own research and is served me well.
    Google is your source for tools & utilities to help you keep track of your own actions. I still have someplace a Process Monitor that logs the exact time i entered a folder/file/or typed a review. Saves a ton of manual typing.
     
Loading...
Thread Status:
Not open for further replies.