Remote Administration

[Otacustes]

Hi all, I am an administrator in a reasonably small company and have been asked by a director to keep an eye on an employee who he believes is contravening our IT policy.

I have been using the administrative share on to the hard drive but this has been disabled. I am also been unable to remotely access the machine or the registry/services etc.

The machine itself is a WinXP machine and are connected to a Win2k server.

Can anyone provide assistance to gaining access again.

Any help is greatly appreciated.

Ota

 

[SLMHC]

\\computername\drive$ no longer works? Did you disable it?

Are you on a domain?

This is a 15 day free trial. It should give you good results.

http://www.softactivity.com/employee-monitoring.asp

http://www.spectorsoft.com/

is the software we use, it was the difference maker for a employee that was on chat porn lines while at work. Its a bit pricey but it will do the job.

Google search for free trials of employee monitoring software, im sure you will find something.

thanks,

Dave

 

[wdoellefeld]

I like VNC to do this. You can run it as a service so the user can't tell. They may see a slight screen blink when you first connect but after that it should run seamless.

With this you can kick back and watch whatever they do, sometimes it's fun to press a key now and then to make them misspell something.

FRCP

http://www.frcp.net

 

[SLMHC]

If you need hard proof i would go with software. Then it no longer becomes your word against his.

Spectorsoft is fully automated and will take screen caps, log keystrokes and much more.

thanks,

Dave

 

[Otacustes]

Thanks for your suggestions all. I don't want to go in too "heavy" handed to start with. If necessary I will have to get the company to purchase the software that has been mentioned here but being tight I wont hold my breath!! ;-)

Can anyone think of some other ways to start with.

SLMHC - yes I am on a domain and $ shares are disables only not by any of the network administrators.

All help is greatly appreciated
Kind regards
Ota

 

[dkediger]

Well, if this employee has been able to disable the administrative share, they are at least suspicious enough and somewhat able to cover for themselves. Chances are good they could detect VNC or other monitoring software.

Depending on what activity is being suspected, an after-hours disk cloning might also be in order - or at least re-enabling of the admin share under the guise of system updates/maintenance.

 

[SLMHC]

I would also re-enable that share and lock down that users privleges through AD.

thanks,

Dave

 

[Phobos1821]

Enable remote desktop for the computer
Start -> Settings -> Control Panel -> System -> Remote -> Check "Allow" remove Desktop -> Select Remote Users -> Add "Domain Admins"

Then run the remote desktop client from another windows XP machine (start -> run -> mstsc -> enter). Or download it for the 2000 server from microsoft. Enter in the computer name, and wolla. remote administration.

I would allow the IPC$ C$ etc.. shares. Allows you to "manage computers" remotly.
AutoShareWks = 1
Registry change. You may have it set as a GPO. If so, remove it.

 

[SLMHC]

Remote desktop does not allow for interactive sessions.

thanks,

Dave

 

[Otacustes]

The frustrating thing is that I am away from the actual terminal that I am monitoring so I am unable to install any software or gain access for a few months which is another reason why I am looking for a non-software type approach.

I appreciate all the responses.


All help is greatly appreciated
Kind regards
Ota

 

[wdoellefeld]

One thing that may be of some use is Grabber. It (along with VNC) is free.

http://www.jsifaq.com/SUBR/tip8900/rh8956.htm

FRCP

http://www.frcp.net