Victim of a wallpaper prank

Posted on 2006-06-08
Last Modified: 2011-09-20
OK. A little history. I'm in a corporate environment with XP workstations. I came back to my desk yesterday after lunch to find my desktop wallpaper had been changed to the Internet Explorer Wallpaper, which was a male underwear model. I'm a guy. I'm straight. This is obviously a prank being played. I'm a good sport. I know when I've been got. I thought it mildly funny. I figured I must have forgotten to lock my workstation before I left for lunch and somebody decided to have a little fun. No big deal.

So today after I get back from lunch I find the same thing. Different picture but the same theme. I'm less amused this time. The first day it was funny. The second time begins to become irritating. And I KNOW I didn't leave my workstation unlocked when I left for lunch today. So now I'm hell-bent to figure out how it was done and who did it. I have an idea of who did it but I'm not positive. A team member. But I'd rather figure out how he did it as opposed to just throwing my hands up and saying "OK, who's been messing with my workstation?"

Here are the facts:
1. My workstation was locked.
2. I wasn't forcibly logged off, had somebody log on a different account, make the change, then logout and log me back on. I had about 8 IE windows open when I locked it before lunch and they were all there when I came back and unlocked it. My password has not been compromised.
3. My normal background is a JPG on my hard drive. The 'changed' background was the 'Internet Explorer Wallpaper'
4. It's possible that the person who did this has access to domain level administrator rights. I do not.
5. I am the local administrator to my workstation.
6. I did find the website the pictures were gotten from when I looked into my IE history.
7. My 'My Documents' folder is redirected to a network server.
8. I checked my security log. With the exception of SYSTEM and NETWORK SERVICES nobody accessed my workstation between the time I left for lunch and came back.

That's the pertinent facts as I can see them. I'm hoping sonebody can tell me how this was accomplished and how I can trace the userID that was used to do it.

And ideas?
Question by:morinak
    LVL 54

    Accepted Solution


    How was your workstation locked?  If you found the website and the picture in your IE history then it was most likely done from your machine and that user account.  If the lock uses your Windows login then I recommend changing your password.  From the information you provided it seems like the prankster has the password and is using your machine and account.

    LVL 1

    Author Comment

    Yes. I've just done some more traditional investigating. I'm the idiot. I was sure I had locked my workstation but apparently I had not.

    weee ... office fun. My next step is to set a trap for the prankster to verify who it is. Then revenge shall be mine!  :)
    LVL 54

    Expert Comment

    Good luck! :D  I'm glad that I could help.  Thanks for the grade, the points and the fun question.


    Featured Post

    Better Security Awareness With Threat Intelligence

    See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

    Join & Write a Comment

    Are you unable to synchronize your OST (Offline Storage Table) file with Microsoft Exchange Server? Is your OST file exceeding 2 GB size limit? In Microsoft Outlook 2002 and earlier versions, there is a 2 GB size limit for the OST file. If the file …
    If you have done a reformat of your hard drive and proceeded to do a successful Windows XP installation, you may notice that a choice between two operating systems when you start up the machine. Here is how to get rid of this: Click Start Clic…
    Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…

    734 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    23 Experts available now in Live!

    Get 1:1 Help Now