1

On my company's computer at work, I found another person's username on my login dialog for Exchange. I examined the security logs and found no traces of remote or local access. No one uses this computer but me.

The username belongs to one of the administrators, and he used remote login long time ago. He also has a user directory. However, I wonder why his username appears now? Is it possible that he logged in and covered his tracks (but not all)?

Is there any other place where i can find if he was logged in recently except logs?

Thanks!

3
  • by default MS shows the username of the last successful login, but there are some things that can mess it up. is this login window one you see and use on a regular basis? It is not easy to delete specific log entires, so if you log contains lots of data, it is less likely that it has been modified. check his profile for signs of recent file modifications to hidden files like NTUser.dat or NTUSer.dat.log. Dec 5, 2012 at 17:59
  • 1
    Is there an actual problem other than another name being in the dialog box? Was your user account compromised?
    – CharlieRB
    Dec 5, 2012 at 18:16
  • Nothing was actually compromised AFIAK. But I it find suspicious that this username appears months after his last (legit) logon.
    – El camino
    Dec 10, 2012 at 9:38

1 Answer 1

2

Sounds like the admin logged in to do his job, and he's allowed to do that. ;) Why not just ask the admin if it was him?

Regardless, if Account Auditing is turned off (which it is by default) there's not going to be a lot of additional info recorded regarding logons.

2
  • 2
    Just as a followup, to techie007's answer, when you say "On my computer at work,", that should properly say On my company's computer at work,"
    – EBGreen
    Dec 5, 2012 at 18:06
  • Well, not exactly, since company policy allows remote access only in case of open tickets. Account Auditing is turned on.
    – El camino
    Dec 10, 2012 at 9:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .