JerichoJones

These are students so WebCams are not an option.

I think I may have to look at sniffing. Bummer. I don’t know squat about that.

Yes I am talking about a user account shared among several people.

The crux of the issue is:

Nothing in the event log ties a user to a computer. If I have the Same ID logging on at the same time there is no way (that I see) to tie them together conclusively.

The computer and user both authenticate but these are seperate entries in the event log…[Read more]

All this would be fine but I am talking about a shared account.

Thanks for the link. It was informative.

If I read this correctly I am still at square #1.  🙁

Fron the Article:
To recap just for a moment, when Fred logs on at his workstation for the
first time that day, the domain controller that handles that logon will log
event ID 672, closely followed by an event ID 673 where the Service
Name…[Read more]