2

We had an issue with our company where someone changed the desktop background on a shared machine to something inappropriate. We're trying to find out if Windows performs logging of when the desktop background is changed so we can track down how it happened. I've tried doing a Google search and combed through the event logs on the machine, but I can't find any info.

I'm a coder and not a sysadmin, so I'm not very familiar with this kind of thing.

Thanks for the help!

Improve this question

1 Answer 1

Reset to default
0

Use Process Monitor v3.05 and set filter registry key HKEY_CURRENT_USER\Control Panel\Desktop

Or set WallPaper value and set read only permission at key HKEY_CURRENT_USER\Control Panel\Desktop.

Improve this answer
2
  • This looks like it will disable a user's ability to change the desktop background. Good for future use, but not what I need now. We're trying to perform a system audit to find out the date/time of an existing background change event, and ideally the user who made that change.
    – RobotNerd
    Jun 27, 2013 at 17:06
  • @RobotNerd To do this, set up audit of the registry. If this happens for all users, then you have either security flaws, or the attacker has details of the system administrator. Or as an administrator ran some files to work with malicious content. For example correcting the problem user under self account. In general, spend time on other things. And security scenarios.
    – STTR
    Jun 27, 2013 at 21:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .