Track questionable user

[Guest Brown]

Hi, I am not sure if this is the proper place to post this question.

I am not a Network Admin but need some help in that area. We recently

hired a new Net Admin who wanted to completely rebuild our network

from scratch. We are a medium sized company and have a good sized

network making that a completely unjustifiable expense and most likely

completely unnecessary. We upgrade whenver necessary. Since then

every so often this Net Admin says that he believes that one of the

servers on the network is in serious trouble and it needs to be

rebuilt. And then two weeks later it blows. We never experienced

issues like this...certainly not as frequently until this individual

came on. The coincidences have been frequent enough that we have

begun to suspect he is sabotaging whatever he wants to rebuild. We

need to prove this. There are times when we believe he is working at

night or on a weekend but he swears he isn't. Is there a way we can

find out if he has been on the network, or what he accomplished when

he was? Any help would truly be helpful.

[Guest Hal Rottenberg]

Re: Track questionable user

 

Brown wrote:

> Is there a way we can

> find out if he has been on the network, or what he accomplished when

> he was?

 

Start reading up on Security event logs and Audit policies. These links

may help:

 

http://technet2.microsoft.com/windowsserver/en/library/d8fc798c-1e77-4043-b59c-971b4961d85a1033.mspx?mfr=true

http://technet2.microsoft.com/windowsserver/en/library/0310c4ce-5fcf-4fdc-a728-dcd3b11963da1033.mspx?mfr=true

 

Then there's the old webcam trick. :)

 

As far as stuff blowing up after he touches it...that really could be

anything. It's hard to say without more data.

 

One thing I can respect is the desire to do things over. Sometimes when

you start a new job you have to take over someone else's mess, no

offense intended. Sometimes, it's better and easier to maintain down

the road by starting with a known value. Especially if the known value

isn't very well known at all (no documentation, etc.). Maybe the best

way to deal with this guy is throw paperwork at him. Tell him to

document each and every change he wants to make, maybe even go to a

formal level of Change Management. It wouldn't hurt, it will slow him

down, and maybe it'll even benefit you if he has good ideas.

 

 

--

Hal Rottenberg <hal@halr9000.com>

Author, TechProsaic (http://halr9000.com)

Webmaster, Psi (http://psi-im.org)

Co-host, PowerScripting Podcast (http://powerscripting.net)

[Guest Holz]

Re: Track questionable user

 

On Mon, 31 Dec 2007 11:48:04 -0800, Brown wrote:

> Any help would truly be helpful.

 

Who says you are not that admin trying to track someone on the network?

 

 

 

--

:-)