There’s a mystery afoot! This employee took it upon himself to figure out who was mysteriously using the office computers in the middle of the night. The culprit ended up being the last person they expected!
“I worked at a law firm. Started getting calls in the morning that some random attorneys could not log in. When we checked out their computer, it turned out they were ignoring their username which was defaulted to the last user logged in. It turned out someone was logging in as user ‘library’.
Checked out the law library and sure enough, a sticky note with the library username and password existed just above the monitor.
This routine persisted for a few more weeks as I tried to figure out how to catch the culprit. Sure I could disable the account, but then we never find out who is ducking into random offices surfing adult websites (that was in the cache of the ‘library’ user account on the local machine).
We used a startup script called kixtart. Highly configurable to do whatever you need it to do. So I added to the startup script to email the administration group whenever the ‘library’ user logs in.
1st night, I get the email…late at night.
I call security and ask them to check our floor. Nothing too unusual. We ask them to check floors occasionally due to stuck open doors from positive airflow etc… They replied back that it was all clear. Huh? Weird. O….K?
2nd night, same story, nothing unusual reported back from security. However, the next morning I come in to a request from and attorney to help him log in, same computer from the night before, default user… you guessed it, ‘library’.
Fast forward a week, happens again. Email notification late at night. Security called. Also notice another attorney logged in a few offices down. I called him immediately and asked him to check the office where we saw the library user logged in. He checks and reports back a few minutes later, “Nothing unusual, just a security guard”. I just called security no less than 2 minutes before. No way they could get to the top floor in time to check on our request. It was the security guard logging in on his break!
Notified the building manager the following morning. They pulled him in, questioned him and he admitted his guilt. He was dismissed immediately.”