Shadow.exe

jgreen726 · 19 Jul 2010 at 09:47

Hi,

We have an issue where we believe a certain user is usuing shadow.exe to look at other peoples screens during work time without their knowledge.

I dont want to edit security or anything like that as i would rather catch the person doing it rather than block it.

I was looking for a gadget (Windows 7) or something like that to alert or give a view of logged on users. I just want something to notify the user if this is the case.

Any ideas?

Cheers

UKDTweak · 19 Jul 2010 at 09:53

Why not use PSList to monitor the dodgy users machine, shadow.exe should appear in the list if they run it, just pipe the output to a .txt and run it even few minutes, can be scripted to do so?

jgreen726 · 19 Jul 2010 at 10:10

UKDTweak said:
Why not use PSList to monitor the dodgy users machine, shadow.exe should appear in the list if they run it, just pipe the output to a .txt and run it even few minutes, can be scripted to do so?

Good idea, thanks for the prompt reply.

i was hoping someone one may have something to popup but i like this idea, good ol pstools

Burnsy2023 · 19 Jul 2010 at 10:45

How do they have rights to run this application remotely?

jgreen726 · 19 Jul 2010 at 11:03

It is one of my collegues!

Burnsy2023 · 19 Jul 2010 at 11:06

jgreen726 said:
It is one of my collegues!

My question stands. If everything is set up as it should, this shouldn't be possible.

paradigm · 19 Jul 2010 at 11:20

Burnsy2023 said:
My question stands. If everything is set up as it should, this shouldn't be possible.

Surely that depends on who his colleague is.

If he is a network admin, he probably has domain admin rights to all the machines anyway.

Burnsy2023 · 19 Jul 2010 at 11:31

paradigm said:
Surely that depends on who his colleague is.

If he is a network admin, he probably has domain admin rights to all the machines anyway.

In which case surely he'd be authorised to do what he's doing?

paradigm · 19 Jul 2010 at 11:40

Burnsy2023 said:
In which case surely he'd be authorised to do what he's doing?

Not necessarily.

If either your contract or computer use policy (if one is in place) doesn't make mention of there being un-notified monitoring of your activity, then legally you have to seek permission either from the individual, or a direct line-manager to proceed.

It gets especially hazy given that you could potentially view personal data.

Totality · 19 Jul 2010 at 11:45

Does he know what he is doing is wrong (if it's even wrong what he is doing? you haven't said who he is!).

Have you tried talking to him first rather than "catching him in the act" as it were? That would be a far simpler first step to be honest.

jgreen726 · 19 Jul 2010 at 13:58

paradigm said:
Not necessarily.

If either your contract or computer use policy (if one is in place) doesn't make mention of there being un-notified monitoring of your activity, then legally you have to seek permission either from the individual, or a direct line-manager to proceed.

It gets especially hazy given that you could potentially view personal data.

Exactly!

Totality said:
Does he know what he is doing is wrong (if it's even wrong what he is doing? you haven't said who he is!).

Have you tried talking to him first rather than "catching him in the act" as it were? That would be a far simpler first step to be honest.

Yes he is aware, it is not being used for its correct purpose. the person in question is a Domain admin as am I.

Thanks for all of your input etc.

SiriusB · 19 Jul 2010 at 15:50

I wonder if he reads OcUK

jgreen726 · 19 Jul 2010 at 16:03

Hope so