Checking info on bad employee

So I've been put on a test at work. I am forced to share a desk with a slob, liar, and slacker. He's so far installed a bunch of programs and claimed I did it to try and get me reprimanded or fired. I need to know how I can prove who installed it, when and also after the fact that they've been uninstalled. Mind you not a wiped hard drive. The biggest problem is McAfee as it's a huge no no here to install antivirus that isn't authorized. I need to figure this out before monday.

I also need to find a way to track his internet traffic as well. He wipes his history but I recall a way to track through the registry. Any ideas?

Punch him inna face. Then check both the system log and application logs. Then, verbally abuse him, making light of both his dubious ancestry and his offensive odors. I got your back.

I already tried looking at the event viewer, only me removing it showed and nothing about it being installed showed at all.

Believe me I will break his nose if I end up on the elevator with only him.

Install a software keylogger.

Unless he is an expert there will be traces left (temp files, installation files etc). Look at file attributes and see who the creator is. Hopefully you don't share the login...
Side note: many programs leave traces in %appdata%\local\temp

He may be using a scrubber program at the most. From what I have been told he's about as good at IT as a blindfolded monkey having a seizure.

Usually it's best to stay frosty, do your job competently, and let these guys hang themselves. As a manager, I always saw the backstabbers and whiners as people that had to be treated with a little caution, but ultimately gotten rid of. Even if they happen to be pretty skilled, they disrupt the team too much are are ultimately a liability. You want to be careful not to start sounding like him, but with less seniority.

I just want the paperwork as my ace in the hole if somehow he does get me in some trouble.

http://www.nirsoft.net/computer_forensic_software.html

The IECacheview program is nice. I always run these things on the drive external not on the sytem live.

You may also consider that he is using a USB drive to do this in which case I typically just disable in gpedit.

Quote:

---

Originally Posted by Niclo Iste

I just want the paperwork as my ace in the hole if somehow he does get me in some trouble.

---

I understand the scenario, and many years ago I figured out that one of my bosses was stealing a bunch of merchandise. Whenever I sat down with him to track our shipping and receiving records, he always got "frustrated" and quit before we could reconcile the numbers. But this was when I counted boxes and read bills of lading to generate reports. Yes, I made copies of every receiving record and "put in service" order I did for merchandise, but that was a hole card I never wanted to play. In the digital age, it's too easy to fake much of the record keeping.

No more worrying about this anymore. I got given my own desk and now he has to share with someone who has more clout than him.

I'll still come over and punch him inna face. I'll wear a derby so you will know it's me.