2
We had an issue with our company where someone changed the desktop background on a shared machine to something inappropriate. We're trying to find out if Windows performs logging of when the desktop background is changed so we can track down how it happened. I've tried doing a Google search and combed through the event logs on the machine, but I can't find any info.
I'm a coder and not a sysadmin, so I'm not very familiar with this kind of thing.
Thanks for the help!
RobotNerd
Posted 2013-06-27T00:37:14.520
Reputation: 121
This looks like it will disable a user's ability to change the desktop background. Good for future use, but not what I need now. We're trying to perform a system audit to find out the date/time of an existing background change event, and ideally the user who made that change. – RobotNerd – 2013-06-27T17:06:31.583
@RobotNerd To do this, set up audit of the registry. If this happens for all users, then you have either security flaws, or the attacker has details of the system administrator. Or as an administrator ran some files to work with malicious content. For example correcting the problem user under self account. In general, spend time on other things. And security scenarios. – STTR – 2013-06-27T21:45:17.323