Tracking control panel access/Domain admin password change

[NTFOOL]

Hi
I have a question that I am hoping you guys can help me with. I have a NT domain, one of my users used to help with administrating the domain. This user became more trouble than she was worth and no longer has any IT responsibilities. Since her demotion I have had multiple missed backups in the evening (Using Veritas 7.0 software, scheduled every night).
In the morning the cause of the missed backup is always the same, the Backup Exec job engine service has somehow been mysteriously turned off. It is important to note I have multiple BDC's running the same software that never experience this, as well when this user was still assisting with the admin duties and all was well these backups never failed.
I suspect this user is monkeying around, I am faced with either changing the Domain Admins password, or logging access to the control panel.
I am a little hesitant to change the password as I assume there are services tied to the login (I inherted this network, I know it is a bad practise to asign the Admin login to services but had never got around to actually changing it).
Can anyone help me with my other option ? If I could prove this user is going in at night and turning off this service perhaps I can get her to stop.

If anyone has any other suggestions as to how I can monitor this users activity it would be much appreciated.
Thanks in advance, any suggestions or information is appreciated

 

[LWComputingMVP]

You could enable auditing and see if there's someone logging in to the server.

But frankly, I would correct the problem you are aware of - change the domain admins password IMMEDIATELY. Then file it away and never use it again. Create a domain admin account for everyone so that it's easier to trace who does what. For example, if your network login is usually "NTFOOL", then create another account called "NTFOOLAdmin" and give that account domain admin rights. (NEVER give your everyday user account domain admin rights unless you're trying to help spyware infect your network).

And if you don't know if the account is used by services, start researching this... I usually create a service account with a password at least 14 characters long and "random" to help ensure they are not easily cracked.

-Lee

Those who ask why, learn

http://www.lwcomputing.com