0

Situation: there is a computer with windows 10. There is also some system that system administrator can change password of windows account from his computer. I do not have idea what software does this.

Can he know my password and login to the windows?

If he cannot know - then he is still able to change it. Lets say he changes it and checks something and then can he change it to the old one? Like in websites it is possible to set in the database old password hash. So in windows case, I would not even know that password was temporarily changed so he could login.

Can I see some logs when he logged in to my computer? Can he delete those logs?

0

Yes. If someone administers your computer (especially in a work environment and your question sounds like one) they:

  • know your user name
  • can learn your password by installing keylogger on your machine
  • can login to your machine with their credentials and access all data (with minor exceptions)
  • can change your password, access the data, restore the system to the previous state, so that the old password remains active
  • can delete the logs showing their access (although likely forensic analysis would prove the tampering)
0

I'm not sure if this is what you're asking for but here is how I do at work to see who's logged into which computer by deploying a powershell script as a logon script via GPO.

Get computer name, user name, current date & time

[string]$ComputerName = "$env:computername"

[string]$UserName = "$env:USERNAME"

[string]$currentDate = (Get-date).ToShortTimeString()

Send an email whenever a user logs in

$subject = "$UserName is logged on '$ComputerName' at $CurrentDate"

Send-MailMessage -To $emailTo -From $emailFrom -Subject $subject -BodyAsHtml -Body $body -SmtpServer $smtpServer

Depending on how your system is configured, you may be able to see who's logged in under 'security' events logs and even if someone deleted the logs, that action would've been logged as well and that's why script kiddies would try to delete logs to cover their tracks while seasoned professionals would attempt to modify logs not delete.

Hope this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.