Possible unwanted access to computer

Discussion in 'other security issues & news' started by aieie, Feb 27, 2014.

Thread Status:
Not open for further replies.
  1. aieie

    aieie Registered Member

    Joined:
    Apr 13, 2007
    Posts:
    175
    Hello,

    one user in my company alerted me that someone could be making access to her computer when she's absent and the computer is on and locked.

    She has a Windows 8 workstation and uses the alt+F4 combo to login / logout; she uses the Windows+L combo to lock the workstation.

    The thing is that there are circumstances when she's not at her PC and when she's back ATL+F4 brings up "Switch user" and not "Shutdown the system" as usual.

    The windows registry events viewer evidences several 4624 access events in the periods the computer should've been locked but I'm not sure those are real login attempts.

    Have you some advice that could help me here?

    Thanks in advance
     
  2. ichito

    ichito Registered Member

    Joined:
    Jan 14, 2011
    Posts:
    1,486
    Location:
    Poland - Cracow
  3. stapp

    stapp Global Moderator

    Joined:
    Jan 12, 2006
    Posts:
    7,307
    Location:
    England
  4. aieie

    aieie Registered Member

    Joined:
    Apr 13, 2007
    Posts:
    175
    Very cool link, it surely will help me to see if there were real accesses or not.

    On the other hand, I was thinking about sniffing traffic from / to that PC next time .... if nothing suspect comes from that the only problem left is phisical access to the PC and that is a problem she has to deal with for herself (changing password and not storing it where other people can read it, for example, LOL)

    Many thanks for your help
     
Loading...
Thread Status:
Not open for further replies.