How can I tell if a user has been screwing with one of our clients?

JOSHSKORN · 06 May 2023

We have several computers in our work available for patron use. Staff (not IT staff) has been saying that a particular user has been messing around with our computers and somehow screwing them up. Now, I really don't have a clue as to what they mean by that, as in I don't have any details. Our computers are locked down, but you can get to anything by using the search bar. We don't take our users for being anywhere intelligent enough to do this. For instance, if a Firefox shortcut gets deleted, I could just use the search bar, find Firefox, open it in its folder and copy/paste the icon. That's about it. On Windows Explorer, the C:\ drive is blocked.

Would the Event Viewer be of any use in finding what a user has been doing to our computers? If so, what would I need to lookout for? Any specific event IDs?

Our computers are completely up-to-date on Windows 10, we automatically install updates as they come.

Malneb · 06 May 2023

Audit that user group and yes you can see what they do in event viewer. Then just have a meeting about it and explain that you know what is happening and then look directly at that person who is implicated, without directly saying it was them.

you won't be able to pinpoint it as him without more engineering not sure how you are setup but just do the meeting and explain that there is ramifications if they continue to do it.

or just forget all that and just have a meeting about it and explain that you know that unwarranted stuff keeps happening on the computers and that it needs to stop, you can only go so far with locking stuff down people like that will find ways to mess around.

or you could just talk to them one on one and say that you are hearing these things from others without name dropping. Fire them if they continue after being asked to stop all though you would nee grounds to do this and might be hard to find reason lol.

Hopefully they will sharpen up after that.

Lol ok patrons yeah idk man public computers you just need to lock it down more. They shouldn't be able to delete anything anyway you can set this. I don't think auditing would be overly useful in this situation tbh just telling you the same of what you already know.

Just lock the computers down properly.

bro67 · 06 May 2023

No the event viewer will not show it. You would have to have auditing enabled.

Try3 · 06 May 2023

You will only be able to find out parts of what has been done whatever you now do.

Denis

User2468 · 06 May 2023

Do patrons not have to sign a log before they use the computer?

csun · 07 May 2023

JOSHSKORN said:

Staff (not IT staff) has been saying that a particular user has been messing around with our computers and somehow screwing them up. Now, I really don't have a clue as to what they mean by that, as in I don't have any details.

Need more specfics from the staff.

Try3 · 07 May 2023

When you have completed your investigation & reversed the unauthorised tweaking [possibly by reinstalling Windows], do consider setting up public computers in Kiosk mode, possibly allowing use of the Edge browser alone.
Set up Assigned Access (Kiosk Mode) - TenForumsTutorials

Best of luck,
Denis