How can I tell if a user has been screwing with one of our clients?


  1. Posts : 193
    Windows 10 Pro
       #1

    How can I tell if a user has been screwing with one of our clients?


    We have several computers in our work available for patron use. Staff (not IT staff) has been saying that a particular user has been messing around with our computers and somehow screwing them up. Now, I really don't have a clue as to what they mean by that, as in I don't have any details. Our computers are locked down, but you can get to anything by using the search bar. We don't take our users for being anywhere intelligent enough to do this. For instance, if a Firefox shortcut gets deleted, I could just use the search bar, find Firefox, open it in its folder and copy/paste the icon. That's about it. On Windows Explorer, the C:\ drive is blocked.

    Would the Event Viewer be of any use in finding what a user has been doing to our computers? If so, what would I need to lookout for? Any specific event IDs?

    Our computers are completely up-to-date on Windows 10, we automatically install updates as they come.
      My Computer


  2. Posts : 1,097
    Windows 10
       #2

    Audit that user group and yes you can see what they do in event viewer. Then just have a meeting about it and explain that you know what is happening and then look directly at that person who is implicated, without directly saying it was them.

    you won't be able to pinpoint it as him without more engineering not sure how you are setup but just do the meeting and explain that there is ramifications if they continue to do it.

    or just forget all that and just have a meeting about it and explain that you know that unwarranted stuff keeps happening on the computers and that it needs to stop, you can only go so far with locking stuff down people like that will find ways to mess around.

    or you could just talk to them one on one and say that you are hearing these things from others without name dropping. Fire them if they continue after being asked to stop all though you would nee grounds to do this and might be hard to find reason lol.

    Hopefully they will sharpen up after that.


    Lol ok patrons yeah idk man public computers you just need to lock it down more. They shouldn't be able to delete anything anyway you can set this. I don't think auditing would be overly useful in this situation tbh just telling you the same of what you already know.

    Just lock the computers down properly.
    Last edited by Malneb; 06 May 2023 at 08:26.
      My Computer


  3. Posts : 9,750
    Mac OS Catalina
       #3

    No the event viewer will not show it. You would have to have auditing enabled.
      My Computer


  4. Posts : 16,581
    Windows 10 Home x64 Version 22H2 Build 19045.3930
       #4

    You will only be able to find out parts of what has been done whatever you now do.

    Denis
      My Computer


  5. Posts : 2,297
    Windows 10 Pro/Windows 7 Ultimate
       #5

    Do patrons not have to sign a log before they use the computer?
      My Computer


  6. Posts : 1,025
    Win10 Version 21H2 19044.1645
       #6

    JOSHSKORN said:
    Staff (not IT staff) has been saying that a particular user has been messing around with our computers and somehow screwing them up. Now, I really don't have a clue as to what they mean by that, as in I don't have any details.
    Need more specfics from the staff.
      My Computer


  7. Posts : 16,581
    Windows 10 Home x64 Version 22H2 Build 19045.3930
       #7

    When you have completed your investigation & reversed the unauthorised tweaking [possibly by reinstalling Windows], do consider setting up public computers in Kiosk mode, possibly allowing use of the Edge browser alone.
    Set up Assigned Access (Kiosk Mode) - TenForumsTutorials


    Best of luck,
    Denis
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 14:03.
Find Us




Windows 10 Forums