How to find who used my machine via Remote Desktop Cntn

if you don't want anyone using Remote Desktop on your computer, disable it:

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/rdesktop_disable.mspx?mfr=true

As to determining the IP of remote access locations, tried setting up a log? Event Viewer logs? Setup firewall logging as well?

http://forums.techguy.org/virus-other-malware-removal/544275-remote-desktop-logging.html

Hope this helps.

Grif

Is it possible it's caused by your browser crashing? What makes you think it's someone doing this remotely, what else do they do on your computer? If it's someone messing with your computer remotely there would be windows opening and you would see a cursor moving around.


Rose

Long story short, even if you find the address of this alleged person, what good will it do you? None. You could try passing it along to various law enforcement agencies, but odds are it'd quickly find its way to the bottom of the list of case priorities. So far all that has happened is something obnoxious, not malicious.

I'll go out on a limb here, and say that based on the level of technical skill you've demonstrated in your three posts here, even if you had a log, you wouldn't know how to make any real use of it. So if it's THAT important you be able to access your system remotely, it'd probably be worth the time, effort, and money to get yourself a VPN connection. Otherwise, you're just going to have to accept the fact that someone knows how to access your computer, and apparently likes to do so often. Remote Desktop is a very insecure system that was intended for use behind the DMZ of a LAN not the Internet.

Install a router, a new model. My D-link DIR-655 has inbound filtering that will block specific inbound IP addresses. I use this when I see in the router logs someone slamming my web site. I block their IP address. In your case you can set the router to only accept inbound traffic from your specific IP address.

Why not disable it when you are at your machine?

Also, isn't it time to use something more secure? Or at least change the passwords. I've lost count of how many machines you turn on and they boot to the WIndows desktop. That's not a machine you want exposed to the internet!
Bob

It's a little hard to decipher, but if you look at the logon/logoff events in security log in event-viewer, one of the events will give you the IP address of the pc connecting to your machine.

And for everyone else. There can be situations where it's entirely valid to have your office computer be accessible through remote desktop, but where someone is just being an idiot and "cleaning up" after themselves.