October 31st, 2005, 06:08 AM
Tracking laptop thefts
Could you please tell me that is there any tool/utility which will give the information about when the machine has been disconnected from network.
Recently we lost a couple of laptops, we were not able to trace exact timings of these when it got disconnected from network. Suspect is on my co-workers, only authorised people can enter that room. I know there are lot of monitoring tools available, but difficult to monitor 100 laptops.
Any tool/utility which alerts or logs when the laptop disconnects from network, so that we can trace who excatly was there in that floor during that particular time.
is it possible to find out from AD through time stamps/KB tickets? if so how?
October 31st, 2005, 06:28 AM
Make sure you auditing is enabled on your security logs.
Look for event id 538.
Event ID 538 can be generated under one of the following conditions :
Event ID 538 Possibilities Logon Type
Network Logoff 3
Net use disconnection 3
Interactive Logoff 2
\"Luck is what happens when preparation meets opportunity.\"
(Roman philosopher, mid-1st century AD)
October 31st, 2005, 06:30 AM
October 31st, 2005, 07:28 AM
Thanks for the reply.
I agree that auditing tracks only when an attempt is made to DC or any other network resource, but if I don't access any of the network resource for a certain period and remove the network cable there will be no trace in audit logs...
Going for commercial products is good when it got stolen, but am looking at some proactive mechanism than reactive.
Please correct me if I am wrong.
October 31st, 2005, 02:10 PM
Hi Pravi~ just a few questions...................
Why do you use laptops in the first place. By design they are portable devices intended to be connected and disconnected?
how is that enforced?
only authorised people can enter that room.
What about cleaners, maintenance personnel, security guards?
October 31st, 2005, 03:32 PM
There's a cheap and simple way to prevent laptops from being stolen..
Experience is something you don't get until just after you need it.