IP and network clues

pma111
pma111 used Ask the Experts™
on
Do any of the windows or other event logs (or any other file or artefact for that matter) on a windows machine capture what network/wifis a machine connects too. And / or the IP address assigned to a machine at a given time (which in this case wont be that issued by our network as it was 'off site' work).
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Most Valuable Expert 2013

Commented:
Only if you've enabled that feature in advance:
http://texhex.blogspot.com/2011/12/debugging-dhcp-on-client.html
Top Expert 2016
Commented:
SSID's are stored in the registry
HKLM\SOFTWARE\Microsoft\WcmSvc
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Unmanaged
HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Network\DataUsage\Wlan\<ESSID>

Author

Commented:
David - are they kept as a log of dates and times of connection, or just evidence that at some stage theyve all been connected too.
11/26 Forrester Webinar: Savings for Enterprise

How can your organization benefit from savings just by replacing your legacy backup solutions with Acronis' #CyberProtection? Join Forrester's Joe Branca and Ryan Davis from Acronis live as they explain how you can too.

Most Valuable Expert 2013

Commented:
SSIDs are just stored in the registry in case they are encountered again, there's no record of when they were used.

Commented:
SSIDs to which the PC has been connected and properties related to them are saved in case you visit that location again.  You can see them in settings manage wireless networks.  Its a tricky screen, but it is possible to see the password used (properties>>security click show password or eyeball), and other interesting information.  I believe some utilities exist that ferret out some of that info as well.
Distinguished Expert 2017

Commented:
It might be easier to answer based on what it is you want to achieve.

Are you looking for a way to audit your mobile system to identify which networks and when it was connected to?

There are asset tracking tools if that is what you are looking for.

Author

Commented:
In case anyone is interested, this Microsoft-Windows-WLAN-AutoConfig Operational.evtx log file has a lot of information in a log format/timeline of networks connected too.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial