RE: Please assist, tracking or IDS options.

[Joe Vasquez]

Do you have a firewall, router or IDS with logging turned on?

 

Do you have security logging turned on in your NT server and any workstations on your network?

 

You may want to mention what security solutions that you have in place.

 

Joe

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of David Ng
Sent: Tuesday, October 23, 2001 5:14 PM
To: [EMAIL PROTECTED]
Subject: Please assist, tracking or IDS options.
Importance: High

Dear all,

    We have a NT network that was hit the other day, in the sense that it was remotely shutdown by an individual somehow. The person might have the passwords and also sound technical expertise in remote utilities. Is there a way for me to trace where the traffic was coming from that day and what IP address? Also, is there a way to automatically capture the screen if it was remotely controlled?

    Please advise, thanks in advance.

 

 

Sincerely,

 

 

 

David Ng