Printable View
I need to write a DLL in the registry to audit when a system is locked and unlocked. I have the materials to do so. However, I was wondering if someone could help me.
http://msdn.microsoft.com/library/de...ry_entries.asp
Maybe a tutorial, or a sample so I can follow?
why would you need to do this. it sound like you are trying to find someone who will tell you how to compromise an unlocked comp.
Yes, Havanger. The whole concept behind the security of knowing when a locked computer is accessed is so I can comprimise it. If you know anything about computers, you know people monitor computer logs from the time the log in to the time they log out, but if the computer is locked, you have no way of knowing when the computer was unlocked. We would like to know exactly when a computer locked and unlocked to know exactly who is using a computer and at what times are they accessing the computer. So if adjusting the audit logs to monitor when a computer is locked/unlocked is a way to compromise a computer you found me out.
Joey,
When the PC is locked... Doesn't it use the current user's account / password to lock & unlock it?
All you could really see from this exercise is when the PC was unlocked/locked, not who did it, because it will just show the account of the user who's session was locked...
This audit really wouldn't help much, unless you suspect someone has the password for another account and is fiddling with the computer... coz then you could compare when they are away from their computer to when the system was unlocked...
And Havanger... WTF are you smoking?!
Yes, and I received a link from a member on AO that showed me what I need to do, but I don't want to bring down the test server. It involves writing a DLL, and has commands to audit = well view this for an idea http://msdn.microsoft.com/library/de...ry_entries.asp you can audit screen saver on & screen saver off, and lock on and unlock, and we would really like to audit these processes.
Matty: they want to ensure no one is unlocking/accessing computers during overnight processing. Hense auditing the lock, also they want to audit how often a user is locking their computer during the day. So if I want to take off for the day, I could lock my computer and leave, well if my computer is locked for 6 hours out of the day, and unlocked for an hour before I leave, what was I doing for that six hours?
Same thing I was doing... Out the back having a smoke... :PQuote:
So if I want to take off for the day, I could lock my computer and leave, well if my computer is locked for 6 hours out of the day, and unlocked for an hour before I leave, what was I doing for that six hours?
Checking that people are actually working, and not slacking off would be a good use for this audit... although it kinda worries me... Please delete this thread before someone from my work's IT Department sees it and implements a similar thing... :)
I know this may be a process that JP will be looking into down the road, I'm sure it will be in the guidelines for anyone that has systems or areas doing closed system processes. I heard through the grape vine that it will be implemented on government own systems and systems running government funded processes, and we are usually one of the first companies to test drive these processes.
NT 4 or Win2K ?Quote:
Originally posted here by JoeyBatch
I need to write a DLL in the registry to audit when a system is locked and unlocked. I have the materials to do so. However, I was wondering if someone could help me.
http://msdn.microsoft.com/library/de...ry_entries.asp
Maybe a tutorial, or a sample so I can follow?