Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

I think that someone at work has logged onto my user account when I'm not in work and moved some files from my desk top to my work in progress. Can this happen? They may know my user name as this is made up of each persons name but, I don't think anyone has may password. Can they still access my desktop etc?

share|improve this question
to answer this we would need to know more about your network. Do you have roaming profiles that move your files with you? – Justin C Sep 20 '12 at 17:22
If you're on a domain, any domain administrators can probably login to your machine using their own username/password. – Brian Sep 20 '12 at 19:22

1 Answer

up vote 4 down vote

Yes, it's actually quite easy, assuming you're on Windows and an administrator on your computer.

  1. Start -> Right click "Computer" -> Manage
  2. Expand Event Viewer on the left pane
  3. Expand the Windows Logs folder.
  4. Click on Security.

Now check through the logs. Look for entries that have Task Category set to Logon. You can use the filter functionality to only show those entries. An audit success means that a user logged on successfully, whereas an audit failure means a user failed to log on. You can see the dates and times that these attempts occured.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.