Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

We had an issue with our company where someone changed the desktop background on a shared machine to something inappropriate. We're trying to find out if Windows performs logging of when the desktop background is changed so we can track down how it happened. I've tried doing a Google search and combed through the event logs on the machine, but I can't find any info.

I'm a coder and not a sysadmin, so I'm not very familiar with this kind of thing.

Thanks for the help!

share|improve this question

1 Answer 1

Use Process Monitor v3.05 and set filter registry key HKEY_CURRENT_USER\Control Panel\Desktop

Or set WallPaper value and set read only permission at key HKEY_CURRENT_USER\Control Panel\Desktop.

share|improve this answer
    
This looks like it will disable a user's ability to change the desktop background. Good for future use, but not what I need now. We're trying to perform a system audit to find out the date/time of an existing background change event, and ideally the user who made that change. –  RobotNerd Jun 27 '13 at 17:06
    
@RobotNerd To do this, set up audit of the registry. If this happens for all users, then you have either security flaws, or the attacker has details of the system administrator. Or as an administrator ran some files to work with malicious content. For example correcting the problem user under self account. In general, spend time on other things. And security scenarios. –  STTR Jun 27 '13 at 21:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.