Hi, I am not sure if this is the proper place to post this question.
I am not a Network Admin but need some help in that area. We recently
hired a new Net Admin who wanted to completely rebuild our network
from scratch. We are a medium sized company and have a good sized
network making that a completely unjustifiable expense and most likely
completely unnecessary. We upgrade whenver necessary. Since then
every so often this Net Admin says that he believes that one of the
servers on the network is in serious trouble and it needs to be
rebuilt. And then two weeks later it blows. We never experienced
issues like this...certainly not as frequently until this individual
came on. The coincidences have been frequent enough that we have
begun to suspect he is sabotaging whatever he wants to rebuild. We
need to prove this. There are times when we believe he is working at
night or on a weekend but he swears he isn't. Is there a way we can
find out if he has been on the network, or what he accomplished when
he was? Any help would truly be helpful.

Brown wrote:
Start reading up on Security event logs and Audit policies. These links
may help:

http://technet2.microsoft.com/window....mspx?mfr=true
http://technet2.microsoft.com/window....mspx?mfr=true

Then there's the old webcam trick.

As far as stuff blowing up after he touches it...that really could be
anything. It's hard to say without more data.

One thing I can respect is the desire to do things over. Sometimes when
you start a new job you have to take over someone else's mess, no
offense intended. Sometimes, it's better and easier to maintain down
the road by starting with a known value. Especially if the known value
isn't very well known at all (no documentation, etc.). Maybe the best
way to deal with this guy is throw paperwork at him. Tell him to
document each and every change he wants to make, maybe even go to a
formal level of Change Management. It wouldn't hurt, it will slow him
down, and maybe it'll even benefit you if he has good ideas.


--
Hal Rottenberg <hal@halr9000.com>
Author, TechProsaic (http://halr9000.com)
Webmaster, Psi (http://psi-im.org)
Co-host, PowerScripting Podcast (http://powerscripting.net)

On Mon, 31 Dec 2007 11:48:04 -0800, Brown wrote:

Who says you are not that admin trying to track someone on the network?



--
:-)