Remote Desktop Connection log

Atom · 05 Dec 2011

I've recently set up a couple of my computers to use RDP so I can log on to them while I'm away from home. During the set up and troubleshooting, I asked a trustworth friend to log on to make sure that everything was working. Lately I've left one of portforwards on in my router, but one still needs the password to get on the computer. This morning I saw that the computer had a windows logon screen which tells me that someone had logged on to this computer. I checked with my friend and it wasn't him, so I'm wondering if I can figure out how this happened and what further measures I need to take to protect my systems.

Specifically, I'm wondering if Windows keeps a log of this, and where I can find it. I'm running Win7 pro.

WebMattR · 05 Dec 2011

If anywhere, I'd guess it would show up in the security log of the computer.

Two thoughts on the matter:
1) I'd guess that nobody is accessing your systems, unless it's a confidential system, with Trade Secrets/User Data/etc. I'm not sure why you saw what you did. most likely a side-effect of your having logged in remotely.

2) If the former is true (trade secrets/etc), why would you store it at home, and be logging in remotely?

Atom · 05 Dec 2011

WebMattR said:

If anywhere, I'd guess it would show up in the security log of the computer.

Two thoughts on the matter:
1) I'd guess that nobody is accessing your systems, unless it's a confidential system, with Trade Secrets/User Data/etc. I'm not sure why you saw what you did. most likely a side-effect of your having logged in remotely.

2) If the former is true (trade secrets/etc), why would you store it at home, and be logging in remotely?

Well, about the only thing on it is trade secrets, but it's not something I would expect anyone to be able to recognize or make use of. I work at home, so where else would I keep this. Plus, when you've logged on to my home network you have some access to other computers. I've changed the port number for RDP and my password just in case.

WebMattR · 06 Dec 2011

Atom said:

Well, about the only thing on it is trade secrets, but it's not something I would expect anyone to be able to recognize or make use of. I work at home, so where else would I keep this. Plus, when you've logged on to my home network you have some access to other computers. I've changed the port number for RDP and my password just in case.

Well, if you've changed RDP port and your password then you should be safe.

Speaking as an IT guy, to someone who sounds like a runs-their-own-business sort, I'd like to provide you with one last pointer that's semi-unrelated: if you run your own business, and you've a lot of critical files/receipts/etc stored on your computer, then I would strongly encourage you to 1) buy a UPS battery back up, and 2) at least have your drives mirrored, if you don't have a seperate machine used for backups.

And if you need any help with either of those, start a new thread, so we don't get yelled at by mods. :)

Atom · 06 Dec 2011

WebMattR said:

Atom said:

Well, about the only thing on it is trade secrets, but it's not something I would expect anyone to be able to recognize or make use of. I work at home, so where else would I keep this. Plus, when you've logged on to my home network you have some access to other computers. I've changed the port number for RDP and my password just in case.

Well, if you've changed RDP port and your password then you should be safe.

Speaking as an IT guy, to someone who sounds like a runs-their-own-business sort, I'd like to provide you with one last pointer that's semi-unrelated: if you run your own business, and you've a lot of critical files/receipts/etc stored on your computer, then I would strongly encourage you to 1) buy a UPS battery back up, and 2) at least have your drives mirrored, if you don't have a seperate machine used for backups.

And if you need any help with either of those, start a new thread, so we don't get yelled at by mods. :)

Thanks for your input. I have a SmartUPS 1000 which is hooked to a couple of car batteries for extra life. I just discarded those puny internal batteries. My information is spread around on different drives on different computers due to the nature of my work, and I use Carbonite.

Barman58 · 07 Dec 2011

One additional security option is the use of an extremal drive for storage of critical files. as this drive would only be connected when you need to access the information it does not risk leaving files available for remote access. If you choose a truly portable option (USB powered) yo can take this with you when you travel and remove the actual need for remote access. Another advantage is that this drive can be stored in a fireproof safe so as to provide total disaster prevention, (though for complete cover at least two mirrored portable drives would be needed, One with you always and one locked away safely).

This may be overkill for your needs but it is the way that gives the best protection for critical business data,

Off site backup of this type of critical data should be something that is considered even if you decide to retain your current system, as this caters for the worst type of natural disaster, fire or similar.

Computer hardware can be replaced but if the worst happens it's the retention of data that can make or break a company.