Need Help Pinning Down Naughty User

[warcrow]

My boss approached me this morning asking me to document and prove that a certain worker (a level 1 helpdesk guy of all things) is playing games and doing other various unauthorized things on his PC.

We know the unauthorized games are on the PC. They're old DOS based files so no installation is required. I plan on file sharing over to his PC with my elevated account and taking a screen shot of the path, so that the machine name and directory are displayed, and then showing the properties of the folder so that the owner of the files is displayed.

Other than this I'm not sure what else I can do. Is there a way to really nail this thing down? I know I can add the column "last used" in the screenshot, but is there anything else anyone recommends?

Anyone have to do this kind of thing before?

 

[corkyg]

Why not just replace the PC with a work station that has no input devices?

 

[bankster55]

Just use a keylogger
there are both software and hardware KL
logs every keystroke
The sw are stealth install and do not show anywheres
The hw ones insert between the keyboard port and cable USB or PS2 or wireless
They are not detectable unless you really know what to look for
$60 and up depending on how much memeory
Just google "hardware keyloggers"
http://en.wikipedia.org/wiki/Hardware_keylogger

 

[Gooberlx2]

You could probably also script some sort of listener that notifies you when the executables are run and who's running them.

 

[warcrow]

Update:

My boss asked me to check his my documents, which is redirected to a network share, and upon investigation I found porn.

Wow.

 

[Malak]

Update:

My boss asked me to check his my documents, which is redirected to a network share, and upon investigation I found porn.

Wow.

Well that solves that one.

Luckily in my state we don't have to do that. We just fire anyone.

 

[sourceninja]

Is that you Frank? I thought we were friends!!! WTF!

But seriously, porn on a work computer? WTF was he thinking?