• RSS
  • Twitter
  • FaceBook

Security Forums

Log in

FAQ | Search | Usergroups | Profile | Register | RSS | Posting Guidelines | Recent Posts

When was a user last on my network?

Users browsing this topic:0 Security Fans, 0 Stealth Security Fans
Registered Security Fans: None
Post new topic   Reply to topic   Printer-friendly version    Networking/Security Forums Index -> Computer Forensics and Incident Response

View previous topic :: View next topic  
Author Message
jcochran
Just Arrived
Just Arrived


Joined: 13 Sep 2005
Posts: 1


Offline

PostPosted: Thu Jul 02, 2009 12:24 am    Post subject: When was a user last on my network? Reply with quote

I'm trying to assist in a current investigation, it goes like this:

User says he was working at "x" time and date.
Manager says he wasn't working at "x" time and date.

I have all of the security event logs for all of my DC's archived and a tool to report on them.

My question is, "what event id's are the best to focus on and how can a paint a user session with this information"?
Back to top
View user's profile Send private message
ryansutton
Trusted SF Member
Trusted SF Member


Joined: 25 Aug 2004
Posts: 67
Location: San Francisco, California

Offline

PostPosted: Thu Jul 02, 2009 12:41 am    Post subject: Reply with quote

While not all inclusive logon/logoff events may build evidence to the case, even better are object access events if you have enabled that type of logging.
Back to top
View user's profile Send private message
jcochran
Just Arrived
Just Arrived


Joined: 13 Sep 2005
Posts: 1


Offline

PostPosted: Thu Jul 02, 2009 1:02 am    Post subject: Reply with quote

That's kind of what I'm thinking... it would be easier to show that the user accessed a file or was authenticated at a certain time.
Back to top
View user's profile Send private message
Display posts from previous:   

Post new topic   Reply to topic   Printer-friendly version    Networking/Security Forums Index -> Computer Forensics and Incident Response All times are GMT + 2 Hours
Page 1 of 1


 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Community Area

Log in | Register