need to verify missing RAM

[brian32]

Hi. I manage several XP computers that have 2 slots for RAM. I recently learned someone stole RAM one of the slots.

How can I verify when the RAM changed? What do I check for in the event logs? Any other ideas? Thanks.

 

[muthabored]

Generally when memory is removed from a system and the system is rebooted, the initial screen that loads indicates that there is a change in the system's physical memory. The BIOS on some of the older PCs (I've seen it with Dell and Compaq) have a setting where it would tell you when the case had been removed but I don't remember it keeping a date or a time. I'm not sure that Windows keeps a log of when such changes occurs but I'd be interested in knowing myself if it somehow does.

 

[linney]

Have you tried MsInfo32 from Start Run?

Under View/ System History. See the drop down dates menu "View changes since".

Maybe there will be something in there about RAM changes?

 

[BionicJohn]

The BIOS on some of the older PCs (I've seen it with Dell and Compaq) have a setting where it would tell you when the case had been removed but I don't remember it keeping a date or a time

That's correct. I added some RAM to a Dell recently and on re-booting the change was logged in BIOS. I think it did show the date and time. I just hit exit and save and never gave it a second thought.



LIVERPOOL FC - 5 times Champions of Europe. 1977, 1978, 1981, 1984, 2005.
Iechyd da! John
Glannau Mersi, Lloegr.

 

[markdmac]

I would use WMI for this.

Here is a script I banged out to do the job. You can set this as a login script. Create a share for the report to be written to and edit the path to that share in the script.

'==========================================================================
'
' NAME: InventoryInstalledMemoryLoginScript.vbs
'
' AUTHOR: Mark D. MacLachlan , The Spider's Parlor
' URL: [URL unfurl="true"]http://www.TheSpidersParlor.com[/URL]
' COPYWRITE (c) 2006 All Rights Reserved
' DATE  : 4/11/2006
'
' COMMENT: 
'
'==========================================================================

On Error Resume Next
Dim WshNetwork, strComputer, objWMIService, colItems, Report, objFSO,ReportFile
Set WshNetwork = CreateObject("Wscript.Network")
Set objFSO = CreateObject("Scripting.FileSystemObject")

strComputer = WshNetwork.ComputerName

Report = strComputer & vbCrLf

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * from Win32_PhysicalMemory",,48)
For Each objItem in colItems
	Report = Report & vbTab & "BankLabel: " & objItem.BankLabel & vbCrLf
    Report = Report & vbTab & "Capacity: " & objItem.Capacity/1024\1024 & "MB" & vbCrLf
Next

'Uncomment the next line if you just want to see the report
'wscript.echo Report
'Delete or comment out the rest of the script 
'          if you just want to see the report

Set ReportFile = oFSO.OpenTextFile("\\<server>\<share>\MemoryInventory.txt", 8, True)
ReportFile.Write Report
ReportFile.close

I hope you find this post helpful.

Regards,

Mark