[vschitturi]

Hi,

I am using a system which is in lan and the os which i am using is windowsxp. I have a doubt can we trace the users who are accessing my system or who are trying to access my system or who monitors my system with different tools like for example VNC like this there are some other tools which can be used for monitoring.

So anybody can give any suggestions how to trace the users.

Thank You for your time.

[skinnywhiteboy]

Sounds like you're a user at some company and want to know if the IT Department is monitoring your activity. Correct me if I'm wrong......

[vschitturi]

No,

I just want to know is there any possibility of finding the users who are trying to access or trying to view my desktop. that sall.

[skinnywhiteboy]

A firewall with good logging capabilities would be your best bet.

[vschitturi]

hi,

thank u very much for the reply but could u please tell me in detail how can we see the users who are trying to access.

Thank u for your time.

bye.

[skinnywhiteboy]

Well if they are trying to access your machine remotely, you would probably only get a computer name and IP at most. If this is on your local network with some kind of infrastructure, there are a lot more sophisticated tools to monitor people. It really depends on your situation.

[vschitturi]

Hi

If anybody access my system remotely i will be knowing because i cannot use anymore my system when someone access my system remotely. My Desktop will be locked when someone is using my system remotely. And when somebody access my system and if we know that somebody accessing my system in live i can trace them by going to computer management - Shared Folders - Sessions there we can trace the user and computer but my question is like that will be there any record of the users stored in my system where we can see th users. Otherwise is there any some third party tools in which i have to install in my system for which to trace the users record who are accessing my system.

Thank You for your valuable time.

Awaiting for your reply.

[TheOutcaste]

A firewall log or a network sniffer would work.

You can also enable Security Auditing and then see different events in the Event Viewer. You turn on Auditing from Administrative Tools | Local Security Policy | Local Policies | Audit Policies. Event id's 682 and 683 will show logon/logoff info including username, domain, Client PC name and Client IP address
See Auditing Security in Windows Help for more info.

If you are using the Windows Firewall, click Start | Run type pfirewall.log and press enter. This will open the firewall log in Notepad

You may have to configure the firewall log to show dropped connections. This is done from Control Panel | Windows Firewall | Advanced click the Settings... button under Security logging and make sure both logging option boxes are checked. This will show successful Remote Desktop connections. Remote Desktop usually uses port 3389

If you are using a different firewall, you'll have to see it's documentation for how to configure logging.

For someone to use Remote Desktop, they have to have an Admin account on your PC, have an account on your PC that has been granted permission to connect using Remote Desktop, or be a Domain Admin.
If you want to prevent users from accessing your system using Remote Desktop, you can turn it off, unless there is a Domain Policy that prevents you from making changes.

HTH

Jerry

[vschitturi]

hi,

Thank you very much for your reply. I hope this will help me the most.