How to see who tried to sign in to the machine, from where, with which account, and how to tell a typo from an attack.

Prerequisites

• Administrator rights (the Security log is restricted)
• Logon auditing enabled. This is the default on Windows client versions, and you can confirm it with:

  auditpol /get /subcategory:"Logon"

Look for “Success and Failure”.

A scheduled job that copies a folder to another drive or a network share, writes a dated log, deletes logs older than 30 days, and writes an Event Log entry if the copy fails.

Prerequisites

• Windows 10/11 (Robocopy is built in)
• Admin rights
• A destination with enough free space (a second drive, USB disk or NAS share).

Windows shows only a percentage. The real indicator is how much charge the cell can still hold compared with what it held when new.

Symptoms

• “The action can’t be completed because the file is open in another program”
• “The process cannot access the file because it is being used by another process”
• A folder can’t be renamed, moved or deleted, even though nothing seems to be using it
• • A background process holds a handle on the file (an Office instance, a media player, a backup agent)
  • Antivirus or OneDrive is scanning or syncing the file
  • A Command Prompt, PowerShell or WSL window has the folder as its current directory
  • Explorer’s preview pane or a shell extension (thumbnail, preview handler) is reading the file

The problem: the company pays for E3/E5 licenses assigned to accounts that haven’t signed in for months. Ten unused E3 licenses is roughly €2,800 a year thrown away.

An expired certificate discovered by your customer rather than by you is the most avoidable incident in IT. This doesn’t need Nagios or Zabbix — a scheduled task is enough.

Most companies sit on p=none and believe they’re protected. They aren’t — p=none only reports, it blocks nothing.

Blocking USB storage outright is easy and causes a revolt. Blocking with a serial-number whitelist is what reality actually demands.