0

Is there a way on Windows 7 to detect if there was any human activity in a certain hour?

My question is not if the computer was in sleep mode - I know it was awake since it was running a torrent client. I'm trying to find out if someone was controlling it remotely.

9
  • Have you looked at the event log? You should also be able to turn on auditing for login/logout. Jun 13, 2015 at 10:00
  • i thought about that, but how can I tell which events happened by human interaction? Also, login/logout won't help since the user is logged in all the time.
    – traveh
    Jun 13, 2015 at 10:03
  • I need to give it some thought. My initial thought is to change Windows settings to put the PC into suspend after an amount of inactivity, you can easily detect when it comes out. Not quite the same thing as you want but a starting point. I'll think some more. Jun 13, 2015 at 10:11
  • You can also "schedule" a task at workstation lock/unlock which is probably your best bet. I'll write up an answer later. Jun 13, 2015 at 10:14
  • Unfortunately putting the machine to sleep won't help since I'm suspecting someone has hacked my machine remotely. I think it happened sometime tonight, so I was hoping to figure out what happened from existing logs, but even if wait for the next time putting the computer to sleep won't help since my wake-on-lan setting is disabled.
    – traveh
    Jun 13, 2015 at 10:16

1 Answer 1

0

You might want to check for following :

  1. Firewall logs : Source IP/MAC address (Logs for given time when you suspect torrent/remote connection) --> what kind of router or firewall you are running : Usually Soho's have logging disabled to reduce CPU usage - I am unsure in your case if router is set to log activities. --> Try going in for static ip on this windows pc - just in case you have more then one pc.

  2. as pointed earlier - Scheduler - Try Scheduling for something like this

Create a file in notepad and save it as watch.vbs

Set shell = CreateObject("WScript.Shell") shell.LogEvent 3, "I was used last night at x hours" Run Scheduler and schedule this task for hours you suspect usage.

  1. Event Log - For any usage related tell tale tracks.

  2. If you have too much time on hands - try searching for files created during those times for any tell tale information.

  3. Last - what if you take out power chord and sleep peacefully ;)

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .