Timeline for Powershell opened up, switched to administrator mode and ran scripts all without me touching my computer. How worried should I be?
Current License: CC BY-SA 3.0
14 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 4, 2016 at 22:29 | comment | added | Iszi | It's worth noting that the event log can be configured to capture a lot of useful information for troubleshooting these cases, but by default it usually doesn't. | |
| Jan 4, 2016 at 22:21 | comment | added | Brad Bouchard | I referenced it in the beginning of my answer/reply to your post here, but sorry for being super late (1 year later) to the party. I simply came across this post while researching something similar at work and thought my advice could be both helpful and beneficial to you and most importantly to other users who stumble upon this in the future so I posted an answer. | |
| Jan 4, 2016 at 21:59 | answer | added | Brad Bouchard | timeline score: 1 | |
| Oct 1, 2015 at 3:41 | vote | accept | Maxwell's Demon | ||
| Dec 20, 2014 at 18:31 | comment | added | user42178 | It could be a scheduled task for updates; I have a similar issue where every day at midnight a command prompt opens and runs some MySQL updates. | |
| Dec 20, 2014 at 12:14 | answer | added | Rory Alsop♦ | timeline score: 6 | |
| Dec 19, 2014 at 3:53 | history | tweeted | twitter.com/#!/StackSecurity/status/545788865790111744 | ||
| Dec 19, 2014 at 2:07 | comment | added | Maxwell's Demon | @ekaj I did not look at the time, unfortunately. I'm in the event log now but there are 64 events with timestamps that look like they could match. Any further clues on how I might track this down (e.g., self-starting shell scripts having a tell-tale piece of metadata attached to them? I'm afraid I don't know a lot about these things. | |
| Dec 19, 2014 at 1:59 | comment | added | cutrightjm | If you know what time it was, it may be helpful to look through your PCs event logs | |
| Dec 19, 2014 at 1:54 | comment | added | Maxwell's Demon | Question updated: I am the sole user and administrator of this laptop. | |
| Dec 19, 2014 at 1:53 | history | edited | Maxwell's Demon | CC BY-SA 3.0 |
Extra info
|
| Dec 19, 2014 at 1:50 | comment | added | atk | Was this a computer someone else administers for you or a personally owned system? | |
| Dec 19, 2014 at 1:46 | review | First posts | |||
| Dec 19, 2014 at 2:16 | |||||
| Dec 19, 2014 at 1:41 | history | asked | Maxwell's Demon | CC BY-SA 3.0 |