No announcement yet.

Who/when was a drive was mapped in Windows 7?

  • Filter
  • Time
  • Show
Clear All
new posts

  • Who/when was a drive was mapped in Windows 7?

    I have an end user that is sure they did not map an X: drive. "It just appeared today." I think they accidentally mapped it (or someone did it for them long ago and they forgot.)

    Also, it pointed to the same public share we all use. Basically, this one user had a G: drive and a X: drive, same directory listing.

    None of my other users see X:. If the end user in question logs into another station, X: does not appear. Group policy and scripts have no X: drive mapping settings.

    Is there a way (perhaps a log on the Win7 machine) that shows who mapped a drive and when?

    The end user is convinced they were hacked and I need evidence one way or the other.

  • #2
    Re: Who/when was a drive was mapped in Windows 7?

    I very much doubt there will be any log -- it is faintly possible there is an audit option, but this relies on auditing being enabled.

    OK -- a quick later and there is an auditing option:

    as it says, this is off by default

    You could, of course, just give the user a new tin foil hat
    Tom Jones
    MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
    IT Trainer / Consultant
    Ossian Ltd

    ** Remember to give credit where credit is due and leave reputation points where appropriate **