 |
 |
We have an intruder repeatedly breaking in to a main office computer(deleting firewalls & antivirus, enabling telnet, installing pirated movies, etc.). The most recent incident was Thursday night/Friday morning. The Windows XP security log shows a logon type 2 early Friday morning. This is supposed to mean a console logon, which would mean that the intruder was in the office directly at the keyboard of the attacked computer, instead of breaking in over the network. Question: Is there any other way to get a logon type 2 in the security log? Or let's take a poll: How many of you think that our intruder is coming in the door, and how many think he is coming over the network? -- David McFarlane Systems Designer Michigan State University, Dept. of Psychology [log in to unmask]