Lock PC (Ctrl+Alt+Del),can be accessed by other than admin

Friend of mine has got two computers (Laptop and Desktop) connected to each other via cross over cable (networked), both computers have got OS win2003 SP2. Normally he accesses both computer via administrator accounts

When he does not use them , he locks them by pressing (Ctrl+Alt+Del), some times he found his son accessed his laptop, he told me that he did not tell his son about the password for the username administrator.

There is no other accounts were created beside administrator account under “Local Users and Groups”.

I have checked by myself the “Add or Remove Programs”, I could not find suspicious program.

Is there away to access a locked PC without knowing the password ?

Some time his dad let his son use the computer when the computer is unlocked. Can the son find out the password for the administrator in some how ?

First thing, was the password a guessable one?

Second, it is possible to access a computer's files by booting off a live CD.

There is another option to consider. If the son knows enough about computers, he may have created an user account for himself. It might be worth checking the user accounts and check if that is the case.

There is another option to consider. If the son knows enough about computers, he may have created an user account for himself. It might be worth checking the user accounts and check if that is the case.

Hehe, he said that has already been checked

It is not possible to access without the password. You could turn on the password auditing for successful and check through the security even log to confirm when the account was accessed.

Cheers

Wayne

hehehe yeah and if the son is smart enough he must have installed a keylogger as well

Most likely, he hit ctrl-alt-del, but forgot to hit lock computer, or missed when clicking on it. (One reason I perfer win+l to lock it, the others being it's faster, less keys, and nothing to click)

If his son isn't an admin, the only way to unlock the machine is via the users password. He could have cracked the user password by using a boot disk on the machine, but unless he has a machine of his own, and is good with computers, this isn't really an option. So the most likely answer, he didn't lock it correctly.