OK So here is the situation:

We have a number of laptops in our organisation. A percentage of the users of these laptops, we beleive never take the laptops out of the building or even out of the docking station. Due to the price difference between laptops and desktops, we want to issue these users with desktops and take away and re-issue their laptops. Due to the political hot potatoe that this has turned into, I need a way to prove whether or not, machines are being used of off the network.

Anybody got any suggestions?

I am thinking I could script something to look for an even entry or the registry entry, but didnt know what to look for. I was hoping there was something that says - Tried to log on to normal network domain, failed, logged on locally.

Can anyone help?


  • 1
    What about laptops that are used out of the office, but aren't ever connected to other networks? We have a number of users who have long commutes to/from work on trains, some of them use laptops to write long documents, or read long documents, or catch up on (previously downloaded) emails. They are all used extensively out of the office but wouldn't be caught by any tool inspecting wireless connections etc. – GAThrawn Sep 9 '09 at 16:33
  • The worst of it is, if the users find out you're doing this, they'll change their behavior to make it look like they do go home with the laptops. – Michael Kohne Sep 10 '09 at 17:04
  • typo: change "of off" to "off of" – davr Sep 10 '09 at 17:06

I assume that since your orgnization provides laptops for people to work from home/road, they log into your network using some sort of a VPN application. In that case, just look at the VPN server log and find out who never logged in.

  • his is a good answer. The exception to look out for would be roaming users that go from one remote siet to another and actually log in at the sites (think regional manager). – EBGreen Sep 9 '09 at 14:44
  • Assumption incorrect. No VPN software in use. – Kip Sep 10 '09 at 10:51
  • How about getting a log from another server accessed remotely? CRM, ERP, Exchange/other mail server - they all have a logging/auditing component that will allow you to get userid + ip. And just a side advice: if the info accessed remotely is valuable to the company, I suggest getting a VPN ;) – Traveling Tech Guy Sep 11 '09 at 17:18

Do the machines run startup or login scripts? What does your corporate infrastructure look like? If this were my problem, there are several things that I could do. I would start by comparing the times that the login script runs to the security eventlog logon events.

  • They do run login scripts upon network logon so I can(and do) record that, but to compare to each machines event logs - would be dificult - unless you can suggest a way? – Kip Sep 10 '09 at 10:54
  • Well, I think that I would have the login script look at the last time it ran then go through the event log looking for login events between now and the last time that the login script ran. If it found any that means the machine was used off the wire. Then have it report that however you want. – EBGreen Sep 10 '09 at 13:04

You could probably combine prey with a script or to to accomplish that.


It might sound like a stupid, simplistic approach, but it definitely does work if you are just trying to prove machines have been used off corporate networks (and by association, taken out of the office)...

Go to the various notebooks' wireless settings and find out if they have connected to other wireless networks (which shouldn't be the case if the notebooks never left the office). Most users forget to delete away the auto-connect wifi network settings.

A client did an audit before - we found that almost 40% of their corporate notebooks have connected to some weird wireless network, with some having multiple unfamiliar networks in their auto-connect settings. Needless to say, we Kensington-locked all machines from then on.

  • I use my laptop on a wierd network at home. – EBGreen Sep 9 '09 at 14:36
  • A corporate notebook should NEVER connect to any network other than the officially sanctioned ones. That is the de facto policy for always-in-office machines. – caliban Sep 9 '09 at 14:38
  • Really? I have a corporate supplied laptop specifically so that I can work from home (and other remote locations) when required. I use a wired network at home. So my machine would not show any wireless connections yet I use it out of the office frequently. – EBGreen Sep 9 '09 at 14:41
  • Er... the question states that asker is targeting those machines that have never went out of the office or off the network. I am not saying this is the catch-all solution, i'm saying you can use this as a quick elimination method. – caliban Sep 9 '09 at 14:44
  • Keywords are always-in-office (or stationary terminals, as we call them) terminals. These machines under corporate policy reqs are not supposed to leave the office - yours is what we call a roaming terminal, in short corporate allows you to take the machine and use it where-ever, when-ever. – caliban Sep 9 '09 at 14:47

You could, in the spirit of big brother, install free tracking software on all laptops. Then you would know where everybody has lately been. You could also maybe pass it off to your administration as a security measure.
See, for example, Adeona :

Adeona is the first Open Source system for tracking the location of your lost or stolen laptop that does not rely on a proprietary, central service. This means that you can install Adeona on your laptop and go — there's no need to rely on a single third party. What's more, Adeona addresses a critical privacy goal different from existing commercial offerings. It is privacy-preserving. This means that no one besides the owner (or an agent of the owner's choosing) can use Adeona to track a laptop. Unlike other systems, users of Adeona can rest assured that no one can abuse the system in order to track where they use their laptop.

  • Interesting thought.... – Kip Sep 10 '09 at 11:02

Wow, a lot of fairly complicated answers here. How about this:

It's probably assumed that a mobile user who takes his\her laptop home shuts it down when leaving the office and turns it on at home. Look in the event log (System) on the laptops and look for system startup events. If you find startup events outside of the normal working hours you can assume that either:

  1. There was a power outage at the office.
  2. Windows Updates has rebooted the laptop.
  3. The user has taken the laptop home and used it from there.

Granted this is not foolproof, but if you find no system startup events outside of the normal working hours then it's probably pretty safe to assume that that user is not taking the laptop home.

  • I don't know the users in question, but if they are anything like me, then no, they won't. I shutdown and restart my laptop as infrequently as possible because the login scripts take about 10 minutes to run. At the least he'd have to look for suspend/resume and hibrenate/resume as well. – Michael Kohne Sep 10 '09 at 17:02

Hardware may be the simpler answer.

Remove the batteries and see who notices. And/or remove the wifi pci card.

Other options include a small dab of rubber cement between the laptop and docking station, it'll pull off easily still, but you should be able to still tell if it's intact.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.