Over the weekend, someone broke in to our offices and made off with a laptop. We have about an 18-hour window when that might have happened. I was hoping there would be an easy way to see, in the server's Security log, a machine being either shut down or disconnected from the network. The machine was on and logged on, but locked, when we left. Is there a descriptor or something I could search for in the Detail field that would scream "here's when the burglars were here, check the video"?
Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations Chris Miller on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
Identify Machine Leaving Network In Security Log
- Thread starter Malinthas
- Start date
Similar threads
- Locked
- Question
- Locked
- Question