How do I prove my client's assistants are screwing up the client's computer?

[mechBgon]

So you don't bother cleaning a system? You just reformat and install the OS at the first sign of infection?

When I was a sysadmin, absolutely yes. Far better to spend a little time doing a reformat/reinstall or a reimaging, and be certain the system is trustworthy, than to wonder if I have a compromised system in the house. But there were very few instances where I felt the need to do that, because the systems were fairly well locked down.

I don't do the freelance PC-service gig, and therefore I don't have "clients" in the sense that you do, so take my suggestions with a grain of salt... they're not always practical!

 

[mechBgon]

BTW if the system does have local group policy (XP Pro/MCE), you can also prevent deletion of IE's cookies and history by Start > Run > gpedit.msc, then drill down to Computer Configuration > Administrative Templates > Windows Components > Internet Explorer, and alter these:

Turn off "Delete Browsing History" functionality

Prevent the deletion of temporary Internet Files and cookies (make sure to set the Temporary Internet Files cache size to something semi-reasonable like <100MB, not 5000MB or something)

Disable "Configuring History"



Naturally, if you want this to result in an accurate view of what's been browsed, you'd need to remove FireFox.

 

[BBCMember]

Thanks for the info. Ended up doing a reinstall, because by the time I got there, I could not get past the blue screen, not even when I tried booting into safe mode.