Numerous logons over break when no one at work.
I've been checking the event logs and it seems over the weekend that most of the computers that I adminster logged on/off when no one was here. It doesn't seem to be a specific user, for instance Workstation7$ logged on/off on saturday a few times as well as most of the other workstations.
Should I be worrying that my network was compromised. It seems that there were no failed logons before hand, which doesn't seem like someone forced their way in. No files were deleted and everything runs fine. There's nothing much more than that. If anyone wants me to post a copy of one of the logs, I'll be more than happy to. Just curious, should I be worried?
Should I be worrying that my network was compromised. It seems that there were no failed logons before hand, which doesn't seem like someone forced their way in. No files were deleted and everything runs fine. There's nothing much more than that. If anyone wants me to post a copy of one of the logs, I'll be more than happy to. Just curious, should I be worried?
Comments
-
sprkymrk
Member Posts: 4,884 ■■■□□□□□□□
Go ahead and post a sampling of the event logs, but I am willing to bet it's normal activity.
Keep in mind that Windows 2000/XP logs a lot of irrelevant event ID 540 occurrences. The Logon Type field in the event description has a number that specifies the logon type - interactive 2, network 3, batch 4, service 5, unlocked workstation 7, etc.All things are possible, only believe.