Key logger for our office laptop

**martd** · 18th February 2011

Hi all

We have an employee who is trying to push for a new work laptop.

Every time he switches on his (work owned) laptop the ethernet drivers have mysteriously disappeared, meaning he cant connect to our network.
I install them again and all is fine - until he goes home.

Funny thing is that they only seem to disappear after he has been home with the laptop.
If he leaves it in the office and it is switched on and off all seems just fine - no disappearing ethernet drivers.

Im after a key logger to see if he is deleting the drivers on purpose.

Any advice on something I could use?

Cheers all.....

**liveseytowers** · 18th February 2011

Can you not just lock him down so he can't remove the drivers any more? If it carries on then you know its not him. I'd imagine using a key logger at work without someone knowing would be a bit of a HR nightmare.

**Mystical_2K** · 18th February 2011

yeah i would avoid the keylogger route mate as you could get into all sorts of trouble if its found, data protection etc. i would lock down the profile so that they can only do the bare stuff they need to and not screw with anything else

**Over Carl** · 18th February 2011

We added something to our IT policy saying something like any data generated is property of the company and may be investigated and/or analysed at any point for any purpose the company sees fit.

That hopefully should get round the RIPA - if they do not consent to us reading they can't use anykit. (Not that anyone even knows where they can find the policy but still.....)

**martd** · 18th February 2011

Thanks guys - i like the idea by Over Carl!
With that in mind would any key logger allow me to see this deletion being done?

Cheers

**liveseytowers** · 18th February 2011

A keylogger isn't going to register the mouse clicks it takes to remove the drivers anyway so I don't think it would be much help really. I've heard of Viruses taking a screen shot on every mouse click so i'm sure there is a tool out there that will do that. I'd still rather just lock the user down if it was happening at my place.

**beerman** · 18th February 2011

Originally Posted by liveseytowers

A keylogger isn't going to register the mouse clicks it takes to remove the drivers anyway so I don't think it would be much help really. I've heard of Viruses taking a screen shot on every mouse click so i'm sure there is a tool out there that will do that. I'd still rather just lock the user down if it was happening at my place.

Exactly, I can delete the drivers for anything all through the mouse clicks.

Remove his admin rights is the easiest way.

**tom999** · 18th February 2011

+1 for remove admin rights

**Waka** · 18th February 2011

I've used this one in the past. It has the ability to take screen shots every x seconds/minutes (it might also do it on mouse click, but I've never used that facility).
http://www.blazingtools.com/bpk.html

**SiE** · 18th February 2011

cant blame the lad for trying. I would do the same for a new company laptop.

The only route here is to lock his machine down. What would the keylogger do? prove he is a cheeky chappy. Its hardly a sacking offence is it.

**plug1** · 18th February 2011

Why don't you just put the drivers for LAN on his desktop , tell him to fix him self ,
Or get him a new laptop , as ther must be a reason he wants a new one .
If worked fine then why would he bother ?

And putting a klogger on his\your laptop is IMO a bad thing to do.

Plug

**burner1** · 18th February 2011

Have you got some tatty old laptop you could show him? Tell him it's not an option for a 'New' laptop at the moment but if he's sure the one he has is giving him problems, the alternative (tatty) one is a bit shabby but does the job.

That's what I used to do with the occasional chancer.. the laptops they had weren't cutting edge or flash, but did what they had to do... the job.

**sgtbarton** · 18th February 2011

Best option is as suggested, show him how to install them himself easy stuff, and if he cannot do that he will just have to find you every morning until the problem goes away , a pain I know but his lack of respect for your it department proves he does not deserve a new laptop.... at least bend the pins in the Ethernet port :-)

Sent from my HTC Desire using Tapatalk

**danthescan** · 18th February 2011

Go Burners way,but give him an old shitty one and lock him out as well.After a week upgrade him to his old one.

**plug1** · 19th February 2011

Putting klogger on his machine is a snide thing to do , and I don't think any disclaimer would get you out the shit if he discovered this.

Plug

**sgtbarton** · 19th February 2011

Not so sure on this, our work has software on all pc,s that takes screen grabs every 5 seconds and apparently key logs everything. U can even find these screen grabs s as they are stored on the individual machines . I wonder if on lunch breaks etc when internet banking And so on if this is allowed . Yet I think places believe if u don't like it don't use work pc,s for personal use. I think the naughty bit of using loggers etc is if the users are not told . But in this case thats exactly what would need to be done .

Sent from my HTC Desire using Tapatalk

**lagigolo** · 19th February 2011

Have you checked to see if his recycle bin is empty? If it is, put something in there and see if he empties the recycle bin. Or a data recovery option that searches for deleted files.

**sgtbarton** · 19th February 2011

See when the last restore point was made . If its in the evening out of hours then ya know something dodgy, should list the change also.

Sent from my HTC Desire using Tapatalk

**Zippeyrude** · 19th February 2011

a keylogger WILL get you into hot water regarding privacy, trust me.

id rather be searching for, as suggested above, software that audits the system configuration and monitors driver settings etc. does the existing windows system tools info not highlight anything under the event logs?