Novell Netware 5.1 User Logs

[star3132]

Hello,
We recently had a user on our novell network whose files were deleted by a malicious user who had stolen her password. While we salavaged the files from the server, (This learning the time/date of the deletion and from what account), we would like to know which computer the user that deleted the files came from. I was hoping that Novell kept a log file of from what computer, time, and which date users logged in.
I couldn't find any information on this from the Internet, but I did find references on ConsoleOne, which I believe we have installed, as it's folder is in our system drive.
Does anyone have any ideas on how to find the log file (if it exists) or how to use ConsoleOne to find it? Thanks!

-Anthony Warren

 

[TheLad]

What you could try is look at the user object in NetWare Administrator. Under the Environment tab there is an option that can tell you either the MAC addresses or IP addresses of any PCs the user object has logged into recently. I am sorry I am so vague but without NetWare Administrator in front of me, I cannot remember.

Hopefully, you can trace the rogue workstation and user from there.

-----------------------------------------------------
"It's true, its damn true!"
-----------------------------------------------------

 

[star3132]

Hello,
Thank you for your reply. Under the Enviroment tab in Novell, all I see is Language, Network Address, Default Server. Then Home Directory: Volume, Path. Could it be somewhere else or more in-depth in these buttons? Thanks.

-Anthony

 

[Jontmke]

In the Environment Tab you can see the Network address field. It will show the addresses the user is currently logged in to. But that does not show history. I am assuming the correct user has logged in since this incident? Then you will probably not be able to find out unless you have auditing turned on. By default it is not because it does use disk space and cpu cycles.

Just goes to show the importance of password security.

JON

 

[TheLad]

The Network Tab does usually show history, you just have to scroll up/down for it

-----------------------------------------------------
"It's true, its damn true!"
-----------------------------------------------------