Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

On my company's computer at work, I found another person's username on my login dialog for Exchange. I examined the security logs and found no traces of remote or local access. No one uses this computer but me.

The username belongs to one of the administrators, and he used remote login long time ago. He also has a user directory. However, I wonder why his username appears now? Is it possible that he logged in and covered his tracks (but not all)?

Is there any other place where i can find if he was logged in recently except logs?

Thanks!

share|improve this question
    
by default MS shows the username of the last successful login, but there are some things that can mess it up. is this login window one you see and use on a regular basis? It is not easy to delete specific log entires, so if you log contains lots of data, it is less likely that it has been modified. check his profile for signs of recent file modifications to hidden files like NTUser.dat or NTUSer.dat.log. –  Frank Thomas Dec 5 '12 at 17:59
1  
Is there an actual problem other than another name being in the dialog box? Was your user account compromised? –  CharlieRB Dec 5 '12 at 18:16
    
Nothing was actually compromised AFIAK. But I it find suspicious that this username appears months after his last (legit) logon. –  El camino Dec 10 '12 at 9:38
    
@FrankThomas Thanks, I'll try that. –  El camino Dec 10 '12 at 9:39
add comment

1 Answer

Sounds like the admin logged in to do his job, and he's allowed to do that. ;) Why not just ask the admin if it was him?

Regardless, if Account Auditing is turned off (which it is by default) there's not going to be a lot of additional info recorded regarding logons.

share|improve this answer
2  
Just as a followup, to techie007's answer, when you say "On my computer at work,", that should properly say On my company's computer at work," –  EBGreen Dec 5 '12 at 18:06
    
Well, not exactly, since company policy allows remote access only in case of open tickets. Account Auditing is turned on. –  El camino Dec 10 '12 at 9:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.