Security breach

[alcor]

Could someone advise whether it is possible to track down last login (or history of logins) to my Win2000 PC. This PC located in my office and hooked to NT domain. I usually leave it in standby mode with password protection enabled. However, today when I come back to office I have found my PC up and running and logged in with my profile.

Someone has used my password to get in.

Any help is welcome very much.

I suspect admin guys did this. I need proof! But still it is a breach of my privacy!

Cheers

[djohn]

Not sure of the answer to your question, others will advise better than I can but if it was "Admin" wouldn't they have used their own password to access your machine rather than use yours then leave it active for anyone else to see?

[homecomputeraid]

You'll have to turn on auditing on the PC to see when someone with Administrator Privileges has logged on.

Here's how to enable auditing using Group Policy:

http://www.microsoft.com/technet/security/.../secmod144.mspx

Here's how to enable auditing locally:

http://support.microsoft.com/kb/252412/EN-US/

Your administrators won't know your password unless you wrote it down or something. They can't see your password, only reset it.

Bear in mind also, that on most corporate networks, you have no inherent right to privacy. You should only be using work computers for work purposes.

You can certainly change your password too. :) (probably the easiest solution?) The most secure way to leave your PC is locked or logged out.