Link to home
Start Free TrialLog in
Avatar of bsharath
bsharathFlag for India

asked on

Someone logged me off how can i find who and did what

Hi,

I had Ctrl Alt Del my machine and out of office.Some one restarted my machine and logged in as the Domain Administrator and logged of the system.I want to find what they did after logging in to my machine.
Did they delete any file ,Copy,Move,Editted any files etc.Is there  a way to find this.

Regards
Sharath
Avatar of ashutosh_kumar
ashutosh_kumar
Flag of India image

you can find out who did log you out from the security log in the event viewer or computer management.

however for the files, if auditing is enabled and group policy has been enabled for "Audit Object access", then only you can find out what files have changed...

else try to find out the modified files by date/time
SOLUTION
Avatar of Speshalyst
Speshalyst
Flag of India image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial