a user in my company lost his office (vpn) laptop for several days (win xp). but was later recovered from the police. being an enterprise domain user, and lots of confidential data in this PC. what specifically are the things/areas we need to check out both in this laptop and in the entire domain to verify that an unauthorised user has not compromised this computer, or even used this laptop to gain access to our enterprise network?. this is w2k domain, dhcp, wins, etc LAN with multiple remote sites

ericcc, If Auditing was enabled on the Laptop, you can check the Logs (System, Application, Security etc.) of XP pro. For W2K Domain, check server logs and attempts to logon/off using User ID. Technology Bytes Plus http://learnitfast.blogspot.com

Assume the data/machine was compromised. You may also want to invest in a data Encryption program. Lots of companies are doing that now, and the Government is now starting to require it after the VA mess a couple of years ago. Life's more painless for the brainless.