Well, you'd have to have access to his event logs on his computer - might be a bit more difficult since it is not on the domain, unless you have the administrator password or you have an administrative account. But you should be able to look for a couple of things: 1) in the security log, you could look for logins by the administrator and 2) in the system log, there should be some entries when an application is installed. You might also check the local users to see if there is another admin-equivalent account he might be using . . .
Thanks, James Winzenz Infrastructure Systems Engineer II - Security Pulte Homes Information Services -----Original Message----- From: Andy Ognenoff [mailto:[EMAIL PROTECTED] Sent: Tuesday, October 28, 2008 7:55 AM To: NT System Admin Issues Subject: Alerts on Install or Elevation of Priviledges I have a user that is somehow installing stuff but his account is only a standard restricted user. This is a standalone laptop, not on the domain at all. Anyone know of a way I could send myself an alert via email if he installs something or logs on as a different account than he should? Only thing I can think of is that he somehow got a hold of the local admin password but I can't see how - yes we disable the LM hash. - Andy O. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ CONFIDENTIALITY NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited. If you have received this communication in error, please notify the sender immediately by email and delete the message and any file attachments from your computer. Thank you. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
