Monitoring a user
Hello,
I need to monitor a specific user on our Windows network. That user is having some type issues where she saves a file, it leaves behind the temp file and then deletes the file she was attempting to save. Does anyone have a recommendation for such a scenario? I am looking for something simple and easy to use and preferably free.
Thanks,
Mike
I need to monitor a specific user on our Windows network. That user is having some type issues where she saves a file, it leaves behind the temp file and then deletes the file she was attempting to save. Does anyone have a recommendation for such a scenario? I am looking for something simple and easy to use and preferably free.
Thanks,
Mike
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
first try to exclude the application(excel/word) from your antivirus software and check the functionality. also this can be because of some third party add-ons.
ASKER
We use Eset Enterprise here. She is the only one on the network having this issue. I upgraded her from Office 2007 to 2010 over the weekend and it seems to have not happened again, but I am not real confident the upgrade is the real fix.
As i said originally the AV is the cause here trust me, excluding directorys is a security risk lets find a different way of doing this.
How can you exclude shared directorys for a start?
The saving process may well be different in Office 2007 than 2010. I remember having these issues myself around office 2007 time.
How can you exclude shared directorys for a start?
The saving process may well be different in Office 2007 than 2010. I remember having these issues myself around office 2007 time.
ok, I would agree sounds like AV, a virus or malware. But sense everyone has the same conifg/av I doubt it is AV.
I honestly say, not put too many cycles into it and rebuild the workstation. If it is a virus or malware, you run the risk of further infections so if it is no too much work to reinstall the OS and software, I would do that.
I honestly say, not put too many cycles into it and rebuild the workstation. If it is a virus or malware, you run the risk of further infections so if it is no too much work to reinstall the OS and software, I would do that.
ASKER
All of these suggestions are great! Can anyone recommend an easy to use and free monitoring tool so I can monitor her network connectivity please?
The process for saving some documents is like this for example with word. it saves lots of temp files and copies of itself through the various saving processes like save, save as, autorecover.
It drives the on access scanning mad on some machines it would seem. Sometimes just deletes the file basically without logging it as a virus even.
Regarding your network tool I dont know of any really.... Not sure why we would want to do this tbh..
We dont know she has done anything right? just boot her machine into safe mode with networking one day and scan it if you need too.
Ensure her pc has no local administrator right granted to her account either, that is the biggest security risk imo, that in conjunction with spam mail.
It drives the on access scanning mad on some machines it would seem. Sometimes just deletes the file basically without logging it as a virus even.
Regarding your network tool I dont know of any really.... Not sure why we would want to do this tbh..
We dont know she has done anything right? just boot her machine into safe mode with networking one day and scan it if you need too.
Ensure her pc has no local administrator right granted to her account either, that is the biggest security risk imo, that in conjunction with spam mail.
ASKER
I want to check to see if her network connection is dropping at all during the day.
ok, run this from a command prompt ping -a ipaddressofyourdomaincontr
This will leave a command prompt running pinging the dc. if it drops you will know there are issues there.
try checking the event log too, it will have something in it.
This will leave a command prompt running pinging the dc. if it drops you will know there are issues there.
try checking the event log too, it will have something in it.
ASKER
Turned of on access scanning and the problem went away. Thank you.