Pau Lo
asked on
IP and network clues
Do any of the windows or other event logs (or any other file or artefact for that matter) on a windows machine capture what network/wifis a machine connects too. And / or the IP address assigned to a machine at a given time (which in this case wont be that issued by our network as it was 'off site' work).
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
David - are they kept as a log of dates and times of connection, or just evidence that at some stage theyve all been connected too.
SSIDs are just stored in the registry in case they are encountered again, there's no record of when they were used.
SSIDs to which the PC has been connected and properties related to them are saved in case you visit that location again. You can see them in settings manage wireless networks. Its a tricky screen, but it is possible to see the password used (properties>>security click show password or eyeball), and other interesting information. I believe some utilities exist that ferret out some of that info as well.
It might be easier to answer based on what it is you want to achieve.
Are you looking for a way to audit your mobile system to identify which networks and when it was connected to?
There are asset tracking tools if that is what you are looking for.
Are you looking for a way to audit your mobile system to identify which networks and when it was connected to?
There are asset tracking tools if that is what you are looking for.
ASKER
In case anyone is interested, this Microsoft-Windows-WLAN-Aut oConfig Operational.evtx log file has a lot of information in a log format/timeline of networks connected too.
http://texhex.blogspot.com/2011/12/debugging-dhcp-on-client.html