I'm looking for some ideas here.
I have a machine that is showing 40+ Guest account logins with a very recent login. The account is currently disabled.
Obviously, one way the logins could have occurred is if someone enabled the account and then logged in as Guest and then disabled the account.
Any other ideas or know of anything else that will increase that login counter?
Operating system?
Operating system?
Ah, sorry. Should have specified. XP Home with SP3.
I'm looking for some ideas here.
I have a machine that is showing 40+ Guest account logins with a very recent login. The account is currently disabled.
Obviously, one way the logins could have occurred is if someone enabled the account and then logged in as Guest and then disabled the account.
Any other ideas or know of anything else that will increase that login counter?
One way I'd look into that is check the LastWrite time on the account keys in the SAM. Other ways would be to look into the Event Log for account mgmt events, as well as check the UserAssist keys for any of the current accounts in the Administrator group to see if any of them accessed the User Accounts applet in the Control Panel. Also look for indications of the use of any programs that might allow user account management.
HTH