Victim of a wallpaper prank

Posted on 2006-06-08
Medium Priority
Last Modified: 2011-09-20
OK. A little history. I'm in a corporate environment with XP workstations. I came back to my desk yesterday after lunch to find my desktop wallpaper had been changed to the Internet Explorer Wallpaper, which was a male underwear model. I'm a guy. I'm straight. This is obviously a prank being played. I'm a good sport. I know when I've been got. I thought it mildly funny. I figured I must have forgotten to lock my workstation before I left for lunch and somebody decided to have a little fun. No big deal.

So today after I get back from lunch I find the same thing. Different picture but the same theme. I'm less amused this time. The first day it was funny. The second time begins to become irritating. And I KNOW I didn't leave my workstation unlocked when I left for lunch today. So now I'm hell-bent to figure out how it was done and who did it. I have an idea of who did it but I'm not positive. A team member. But I'd rather figure out how he did it as opposed to just throwing my hands up and saying "OK, who's been messing with my workstation?"

Here are the facts:
1. My workstation was locked.
2. I wasn't forcibly logged off, had somebody log on a different account, make the change, then logout and log me back on. I had about 8 IE windows open when I locked it before lunch and they were all there when I came back and unlocked it. My password has not been compromised.
3. My normal background is a JPG on my hard drive. The 'changed' background was the 'Internet Explorer Wallpaper'
4. It's possible that the person who did this has access to domain level administrator rights. I do not.
5. I am the local administrator to my workstation.
6. I did find the website the pictures were gotten from when I looked into my IE history.
7. My 'My Documents' folder is redirected to a network server.
8. I checked my security log. With the exception of SYSTEM and NETWORK SERVICES nobody accessed my workstation between the time I left for lunch and came back.

That's the pertinent facts as I can see them. I'm hoping sonebody can tell me how this was accomplished and how I can trace the userID that was used to do it.

And ideas?
Question by:morinak
  • 2
LVL 54

Accepted Solution

b0lsc0tt earned 1000 total points
ID: 16864228

How was your workstation locked?  If you found the website and the picture in your IE history then it was most likely done from your machine and that user account.  If the lock uses your Windows login then I recommend changing your password.  From the information you provided it seems like the prankster has the password and is using your machine and account.


Author Comment

ID: 16864451
Yes. I've just done some more traditional investigating. I'm the idiot. I was sure I had locked my workstation but apparently I had not.

weee ... office fun. My next step is to set a trap for the prankster to verify who it is. Then revenge shall be mine!  :)
LVL 54

Expert Comment

ID: 16865191
Good luck! :D  I'm glad that I could help.  Thanks for the grade, the points and the fun question.


Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

There are 2 things you must have in order to connect to the internet behind a router, The "Gateway IP" of the router, which is usually something like 192.168.xxx.1, I've seen routers with default values of:,,, …
Migration of Exchange mailbox can be done with the ExProfre.exe tool. But at times, when the ExProfre.exe tool migrates the Exchange Server user profile, it results in numerous synchronization problems. Synchronization error messages appear in the e…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
Is your OST file inaccessible, Need to transfer OST file from one computer to another? Want to convert OST file to PST? If the answer to any of the above question is yes, then look no further. With the help of Stellar OST to PST Converter, you can e…
Suggested Courses

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question