Clearing all event logs and transaction history

Hey, I'm a computer operator and the network admin that works with me is a real *ss. My question is I don't want him looking at what websites i went to nor do i want him lookijng at any type of event history or ANYTHING i know how to clear event logs, url history, internet files, recent document history, is there anywhere else he would look? I think i have all covered but i'm not the best so any other suggestions after i get it i plan on making a script to clean up this workstation before i go home everyday so.... a litte bit of help would be much appreciated


cheers X0x0

hmmmm..

Seems a buit suspicious to me.


Looking at porn on company time?

Just because you clear your event log and other things doens't mean he doesn't have a program on the gateway monitoring urls connections etc.

Just don't mess with your computer, you'll just get into more trouble.

I have people a lot of times that think they hid the websites they visited by doing what you do, but to no avail as theres other means of monitoring what you visit than looking at your logs and internet cache.

Well, I have good news for you and bad news also.
1. If your admin is a lazy know nothing sort, the things you are doing will cover you very well.
2. If your admin has anything on the ball at all, you have already been busted and there is nothing you can do to hide your tracks.

System logs (which you can't get to to clean up) will list out every site you have gone to and the exact times and duration of every visit. There are ways that he could even be taking screen shots of the sites you are visiting.

Depending on what kind of acceptable use policy you signed when you started with your company will determine the actions he can take against you.

Kind of scary when you mess up real bad, isn't it?

I gotta go with cheyenne on this: Seem's a little suspicious to me. Whatever websites your going to that you don't want him to know about, why don't you just go on them at home instead of during your time at work. Make's life easier and solves problems.. plus it doesn't give your boss a reason to think your doing anything wrong.

Hey, thanks for the tip.
and no i haven't been doing anything wrong at all the admin actually clears all of his logs and history stuff.
I don't look at porn the worst thing i've done yet is probably post messages on this site. It's just the principle if he is going to delete his stuff i'm going to delete mine. He's the type that if you have a computer question he will refuse to share any knowledge of any sort with me. If i have a problem he tells me to ask my boss. nd no I haven't been doing anything wrong......I was looking at the files on his computer and he

Quote:

---

I was looking at the files on his computer and he

---

........ Just walked into the room so I pressed "Submit"....... ROFLMAO...... ;)

The idea that clearing local histories will prevent network admins from seeing what you've done is probably about as good as the boogie man myth. I have legions of fools who accept this idea as true. Meanwhile, anyone who understands a shred of networking knows that traffic leaving your local network must pass through other devices. Even if your net admin is a schlub, your firewall admin might be (and likely is) sharp as a blade.

Based on the ignorance explained above, I spend a good deal of my day busting pr0n hounds who thought they were pretty slick by deleting local temporary internet files. They leave quite a large pile of poo in their pants when I drop a nice Websense report on the table which methodically catagorizes all of their horribleness.

Bottom line - If you are at work, you WILL be caught. It's only a matter of time.

Perhaps there is a good web anonymizer site out there that could cover his tracks, that would keep the admin from knowing the names of the sites he visits if all he logs is IPs, but he would have to find one that uses SSL or the admin could sniff the data and see what kind of content it is (and what site it was really going to).

Quote:

---

......I was looking at the files on his computer and he

---

Oh dear, i wander if he still has a job :D

Irongeek, looks like your advice may have come to late ;)

At my last job when I got bored I would simply watch my DNS servers as they resolved. Since I had a list of who had what address I could often catch people in 'real time' surfing to sites they shouldn't. If you want to hear someone freak out call them up about 30 seconds after logging into a porn site at work and say "Why are you logged into www.big****.com?" Oh....you should hear them scramble and stammer.

If DNS didn't catch them, Packeteer would, or Symantec Web Security, or occassionally--if there was an extremely high volume of traffic-- I'd see it in my firewall or IDS logs and look it up.

I'm sure that some stuff got past me, because to be honest, I didn't really care to be the internet police. But the number of people I busted was unbelievable.

Go ahead and clean your local logs. Won't do you a bit of good.

Thread:

Search AO for Slarty's GenControl and d/l it.

Wait till an offender is doing the "dirty deed" and connect to their box. When you can see what they are doing, (without them knowing), do a:-

net send offending_computer Should I send the logs of this to your supervisor or have you some more surfing to do yet?

You'd be surprised how quickly they can close all those pr0n pop-ups..... :D

My famous words to our last employee

"you can delete, but you can't cover up" (well not really, but I thought it sounded good enough to post :p)


bottomline:
Just don't try to hide anything, theres more tools out there than you can imagine that records your internet activity, takes pictures of your desktop every 30 seconds, un-deleted temporary internet cache and cookies, remot control of your computer.

Trust me as we just fired one employee who thought she had hidden her tracks viewing sites against our policy, but a couple old surf throught the gateway logs, and a little looksie through here deleted cookies and voila!!!

Quote:

---

........ Just walked into the room so I pressed "Submit"....... ROFLMAO......

---

this is actually really funny, shouldn't this thread be moved? :D

Quote:

---

Perhaps there is a good web anonymizer site out there that could cover his tracks, that would keep the admin from knowing the names of the sites he visits if all he logs is IPs, but he would have to find one that uses SSL or the admin could sniff the data and see what kind of content it is (and what site it was really going to).

---

WebSense sees this too. We have users who constantly try to beat the system only to be busted before they get to search for their beloved pr0n.

:)

Quote:

---

Originally posted here by thehorse13
WebSense sees this too. We have users who try to beat the system only to be busted before they get to search for their beloved pr0n.:)

---

Question horse, if you have "users" that constantly try to beat the system, why are they still users ? ;)

Cheers:

Quote:

---

constantly try to beat the system, why are they still users

---

Not that easy sometime. :) Especially when no formal policy exists and they perfrom some critical function. Like it or not sometime you have to tolerate crap, assuming they aren't breaking a law.

Quote:

---

he would have to find one that uses SSL or the admin could sniff the data

---

If you leave my network and ssl is detected going to a site not on the A list, you go to the top of the list. Same with PGP, PGP emails are actually quarentined and they DO NOT leave the network except to specific addresses.

Quote:

---

Originally posted here by RoadClosed
Especially when no formal policy exists

---

Horse really doesn't strike me as the type to not have all the right policies in place. ;)

Cheers:

Me either, so he is being nice and warning them?
;)

I have a friend that worked in a small office with an admin that apparently didn't use any method for checking to see where people had surfed other than looking through files on the computer - so everyone would just delete cookies and history and stuff. The one day the admin found an uneraser utility where he could run it and bring up all the goodies that he wanted to see. My friend still didn't get caught tho b/c he was smart enough to use a real eraser that would make it impossible to bring up deleted files. If the admin got wise and used *any* kind of surf-logging program then everyone in that office would be screwed - including my friend.

I'd suggest that anyone in a business environment that allow employees to access the internet monitor everything, have policies in place stating what is acceptable use and what isn't along with the standard warning that states:-

Disciplinary action up to and including termination

or they are asking to be sued by an employee for creating a "hostile work environment" at a minimum.... The penalties the courts manage to come up with will break a lot of small businesses....

Is the hard work you put into you company worth the crap one money grabbing little minion can cause you compared to the relatively small cost of software that can report the activity and the time it takes to take a quick look through it every week?

The "hostile work environment" is why many spend the time and money to eradicate a potential risk. Workers in this country have a Federal mandate to a safe environment that includes managing what could be sexual hostility through pornography. But, there is no requirement to have technology mechanisms in place and as long as a company says it's "not ok" and then reacts to complaints by emplyees. It is MUCH easier just to eliminate it all together though technology.

But if you walk into court and say that we have a policy that says you can't do it there's a million lawyers out there that will prove that you _could_ have placed technological solutions in place but that you didn't care about the welfare of your employees. Then the only leg you have left to stand on is that wooden one in the back closet that the termites got to last year.....

At least if you can show that you _monitor_ and that you check the logs regularly, (per a laid down policy), and that you have a disciplinary policy in place should such activity be found, (better yet have an example of disciplinary action you have taken - even if it is only a warning), then you have a chance at keeping the thieving bloodsuckers at bay.

I monitor... I block.... I randomly watch for too many ad sites being accessed in real time.... I watch your desktop without you knowing it if your activity becomes "suspicious"..... I warn you, (and save the warning), if you are being bad..... I create a file on you if you continue and warn you further.... I inform your supervisor with a copy of the warnings.... I cut off your internet access if you still continue and inform the administrator of the employees actions and the supervisors inactions at that point.....

Am I a complete bastard?.... Yes.... Is it my job to prevent those that would risk my company's existence from doing harm?... Yes.... It's why they pay me...... and I have the policies in place and email the AUP every three months to everyone on the network.... So they can't say they don't know.... Because they got the AUP in the orientation too.....

I do give flexibility..... I don't allow abuse..... It's my network.... You play by my rules..... :D

And it takes me a few minutes a week at a cost of less than $5 per user per year..... SWEET...

Bastard.

I am one as well. But in reality as long as a company "reacts" that is the key. If an employee says, "I think T.S. is surfing exciting fishing sites and I don't like it", and you as a company discipline T.S. according to policy, then the company took reasonable steps to ensure safety without spending 20 grand which could be 6 months of total profit; assuming T.S. did nothing illegal because we all know he is a member of the Upright Citizens Brigade and wouldn't drool over taxidermy sites at work. Most of the time even if T.S. is doing something illegal, Law Enforcement will get T.S. and leave the company alone. Catch 22, unless they had monitoring software in place and did nothing to prevent Bill from downloading. :D

Most small businesses that make America tick don't have squat invested in technology. Having played devils advocate, if you don't monitor employees you are crazy because in a large company there is no way to enforce a safe environment without it. There are way too many variables and relying on written policy and communication is, well stupid. And the next person let go or pissed off is going to open fire on an executive team with their pants around their ankles.

ahh the joys of using microsofts remote desktop connection to connect to my home computer then from there roam the internet freely without filters or logs. MUAHAHHAHA (this is how I got around websense in highschool)

Wanna try getting past me un-noticed XTC..... Already had an administrator disciplined because her husband thought he knows about computers.... Oh... BTW, he's a supervisor for a major, and I mean _major_, EDS account..... In a 3 month period he tried everything he knew including gotomypc through http etc.... Caught the moron every time.... :rolleyes: I hear he hates my guts after what I said about him got relayed to him.... Oh dear..... :D

Well, You guys have helped me a little bit. Very amusing ..... I STILL HAVE MY JOB! : P*
thanks!