Link to home
Start Free TrialLog in
Avatar of Pau Lo
Pau Lo

asked on

IP and network clues

Do any of the windows or other event logs (or any other file or artefact for that matter) on a windows machine capture what network/wifis a machine connects too. And / or the IP address assigned to a machine at a given time (which in this case wont be that issued by our network as it was 'off site' work).
Avatar of ☠ MASQ ☠
☠ MASQ ☠

Only if you've enabled that feature in advance:
http://texhex.blogspot.com/2011/12/debugging-dhcp-on-client.html
ASKER CERTIFIED SOLUTION
Avatar of David Johnson, CD
David Johnson, CD
Flag of Canada image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of Pau Lo

ASKER

David - are they kept as a log of dates and times of connection, or just evidence that at some stage theyve all been connected too.
SSIDs are just stored in the registry in case they are encountered again, there's no record of when they were used.
SSIDs to which the PC has been connected and properties related to them are saved in case you visit that location again.  You can see them in settings manage wireless networks.  Its a tricky screen, but it is possible to see the password used (properties>>security click show password or eyeball), and other interesting information.  I believe some utilities exist that ferret out some of that info as well.
It might be easier to answer based on what it is you want to achieve.

Are you looking for a way to audit your mobile system to identify which networks and when it was connected to?

There are asset tracking tools if that is what you are looking for.
Avatar of Pau Lo

ASKER

In case anyone is interested, this Microsoft-Windows-WLAN-AutoConfig Operational.evtx log file has a lot of information in a log format/timeline of networks connected too.