As we are having the following problem in the office (small company without an IT person) I was wondering if it is possible to find out when someone last logged on to their PC.
Email: Exchange server (externally hosted)
PC OS: XP
Productivity SW: Office 2007
Someone is logging on to a PC and looking through the mail archive saved to the local drive of the PC. They then change the time and date of the PC (using the tool that you get to by double clicking on the time at the bottom right of the screen) and send email that the PC's user has previously received or sent (mostly personal, but some business email as well). Because the PC is not logged on to Exchange these emails only wind up in the out box to be sent, rather than being sent immediately. They do however, wind up with a date and time stamp that reflects the changes that the person made. E.g. Even though they access the PC on Sat at 3pm, they change the dates to Monday at 9am and this is what is recorded on the emails in the out box.
What happens next is that when the user of the PC next logs on to Exchange the emails in the out tray get sent without them noticing it. Because the person doing this changes the date and time to the time that the user will next be in the office it looks as though the user is sending these emails.
We figure that if we can check when the PC has previously been used we may get a better idea of who is doing this.
Any ideas would be great.