How do I redirect a user's profile history files on Win XP 1

[tschuy]

Hi Everyone,

I've just been tasked to be a spook and go into a corporate users PC and edit the registry to trap IE history files and send them to another location. This individual has been in the habit of going to the porn sites on the companies PC and has inturned offended someone. The HR office and Corporate security wants me to trap these records. I've done this before with Windows 2000 Pro but not yet with Windows XP. I've searched the registry and have found the individuals profile, but also noted that history has been set to zero. Is there a way that I can capture this stuff and send it to a different location without he/she knowing about it?

I know it sucks when doing this to a fellow coworker and really don't enjoy the fact that I've been taksed to do it.
Any help would be appreciated.

Thanks...

 

[gpalmer711]

I can think of several ways of doing this, such as changing the history to 30 days then using group policy to lock any changes to that setting.

Using a 3rd party utility to track sites visited etc..

The thing with all of them are that it is pretty hard to make it so that he/she will not know what is going on.

Greg Palmer
Freeware Utilities for Windows Administrators.

http://www.palmersoft.co.uk

 

[rvnguy]

tschuy,

There are many packages to accomplish this a couple w/links below.

wavecrest

http://www.wavecrest.net/searchad/general_eim/g_tracking.html

internet access

http://www.systracker.com/

key-tracking

http://www.keylogger-download.com/key-tracking.html

rvnguy



"I know everything..I just can't remember it all

 

[tschuy]

Thank you rvnguy...

Much appreciated. I looked at those options and it would be pretty easy for a user to see if he/she was being watched since it would require a proxy to be established on the monitored system. This would mean that if he/she wereto go to another computer and check the IE proxy settings they would notice something different. Like I stated in my initial post I was able to re-route the history to another location pretty easy in Win2K but I'm having problems doing so in WinXP...

Does anyone else have some suggestions?

Thanks,

Tim Schuy

 

[rvnguy]

tschuy,

Not sure if you this or not:

How To Change the Default Location of User Profiles and Program Settings

http://support.microsoft.com/default.aspx?scid=kb;en-us;322014

rvnguy

"I know everything..I just can't remember it all

 

[J741]

I know that many broadband internet routers and firewalls have logging options, so how about this:

In the electrical room, wiring closet, or wherever your company's main HUB is located, disconnect the network patch cable for the user's computer, and connect it to a BIR (broadband internet router or firewall) instead. Then connect the WAN port of this BIR to your company's network HUB. Configure the BIR so that it's LAN IP address range is on a different subnet from that of your company (if your company uses 192.168.1.*, then use 192.168.2.* on the BIR). Then set the 'DMZ' in the BIR to IP address of the user, to allow almost direct network access. Then enable logging of all outgoing activity in the BIR.

I'm not completely sure if this will work for you, and there may be some issues due to the segregation of this user from the network, but it may be worth a look.

- James.


My memory is not as good as it should be, and neither is my memory.

I have forgotten more than I can remember