Change date on workstation

I need to check and see if an employee has been changing the date on her workstation with XP Pro.  Have been told how to check. Question: can this be done remotely with I go in on her cmputer?  How far does the audit go to see if dates were changed?
LindaWebbAsked:
Who is Participating?
 
ploftinConnect With a Mentor Commented:
Look in the security event log on the workstation. Specifically for event ID 4616.
0
 
Coast-ITCommented:
Just stop users from changing time in grou policy or local policy if you dont run a domain ;

Computer Configuration -> Windows -> Security -> User rights assignment -> Change the system time.

By default only power users and administrators can change the system time, but you can lock it down to groups here.
0
 
LindaWebbAuthor Commented:
The office where I am supposed to check for embezzlement uses a domain and they did not have it set up where the user could not change the date. Live and Learn!  So I need to see if she changed dates in the past.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.