Safe mode - anonymous user - logs

Toshiba / Equium
January 5, 2009 at 13:50:19
Specs: Windows XP - SP3, Intel Centrino Mobile 1GB
Hello friends/gurus,

I am on Win XP - SP3..

I logged into my laptop today and found some important files missing from one of the folders. I suspect one of my colleagues have logged into my laptop and deleted them.

I have two user accounts on my laptop
1. Administrator
2. Chalfont
(while the Guest account is disabled).

User Chalfont is password protected where as Administrator isn't. The Administrator user account shows up only when starting in safe mode(It doesn't show up when starting in normal mode - In normal startup mode, all we can see is just the Chalfont user).

I am very sure that they couldn't have logged in via the Chalfont user account as no one know's the password.(I had changed the password the same morning).

How can I find out if anyone else has logged into my laptop using the safe mode option and then logging in with Administrator account. Are there any logs or anything of that sort which shows the user logging activity. If so, what and where are those files located.

If not, can anyone else please suggest any other ideas/hints. Please ask if you need anymore details.

Thanks in advance

See More: Safe mode - anonymous user - logs

Report •

January 5, 2009 at 14:37:45
Event log will show that. Right-click My Computer, Manage, System Tools, Event Viewer, Security Log. You may or may not be able to view the log as a regular user. You can, however, login with the Administrator account and then view the log. You can then see which users logged in at what times, and log off times as well.

Most importantly though is why don't you have your Administrator account password protected? That's the vulnerability to attacks both inside the network and from outside.

"So won’t you give this man his wings
What a shame
To have to beg you to see
We’re not all the same
What a shame" - Shinedown

Report •
Related Solutions

Ask Question