I have an account at work that I can access through the internet. I suspect someone is logging on. Is there a way to identify who has been accessing the account if they are using my logon and password from a remote pc?

Hello Willaren,

Welcome to PCHF.

You can check the event logs of the server your connecting to, or if your connecting to a domain account, you can check the log's of the Domain Controller (You will need to ask your IT department if you don't have access to the Domain Controller, or if you don't have an administrator account). From the server, go to Start, Run, and type in eventvwr and press OK. Click on the "Security" category on the left hand pane. On the right hand side, you will see a list of security events. Under the "Category" field, you will see "Logon/Logoff" events. It will tell you the date and time of the event. If you double click on that item, you will be able to confirm the username that was used to logon.

If your account has been compramised, there is a simple solution.. change your password!

If my user name and password were used, the log would only show that I logged in. Is changing my password the only thing I can do or can I find out who logged in with my user name and password.

You will need to write down when you are actually logging in, and compare that with the logs. Any entries that appear in the logs, that don't tally up with when you are logging in will identify if this is actually happening, however there is no way to trace exactly who would be logging in as you in any case. Changing your password is the only way to stop it completely.

Thanks. It's disappointing that I can't trace who is logging in under my name, but I'll be changing the password today for sure.

OK willaren,

Marked as answered.