Hello all.
So I'm at a loss. A former coworker of mine started working part time at the office. He used to be the Mac imaging lead, but now I am. I, however, have no knowledge in scripting actions or notifications. He and I had a falling out some time ago, and now he just started working part time again at the office and has access to passwords (authorized by the higher ups. go figure). Now, he has begun to screw around with my projects (deleting programs and files here and there) because i wont ask him for help and basically he's always been an a**hole.
For instance, we are re-imaging several classrooms. They were completed tonight, finally finished with all the settings polished and ready to go. He shows up, learns from another coworker (who was helping me--not his fault. he didn't know what the guy would do) what room I was working on, and when I go back into the room, half the installed applications on every machine are missing. I've got half a dock of question marks. Now...this sets me back a day but I can reinstall the missing program packages. But it's things like this, that are starting to escalate matters. And I can't prove anything.
He knows the admin passwords, which are regulated by administration--and they still trust him. So everything he does is essentially anonymous. I was going to try to make a script to notify me every time a file is removed from the applications folder and have a log with timestamps in it.. but even if I had that, I couldn't prove it was him... I believe he's using ARD, or issuing commands by ssh to the remote computers.. is there any way to trace or log commands that have been issued to the computer?
Also, I would still love to know where to start with that notification script...
If anyone has any ideas how I can try to catch this guy, I'd love to hear them. Because as of right now I have no way to PROVE he's doing these things, though I know it's him.
So I'm at a loss. A former coworker of mine started working part time at the office. He used to be the Mac imaging lead, but now I am. I, however, have no knowledge in scripting actions or notifications. He and I had a falling out some time ago, and now he just started working part time again at the office and has access to passwords (authorized by the higher ups. go figure). Now, he has begun to screw around with my projects (deleting programs and files here and there) because i wont ask him for help and basically he's always been an a**hole.
For instance, we are re-imaging several classrooms. They were completed tonight, finally finished with all the settings polished and ready to go. He shows up, learns from another coworker (who was helping me--not his fault. he didn't know what the guy would do) what room I was working on, and when I go back into the room, half the installed applications on every machine are missing. I've got half a dock of question marks. Now...this sets me back a day but I can reinstall the missing program packages. But it's things like this, that are starting to escalate matters. And I can't prove anything.
He knows the admin passwords, which are regulated by administration--and they still trust him. So everything he does is essentially anonymous. I was going to try to make a script to notify me every time a file is removed from the applications folder and have a log with timestamps in it.. but even if I had that, I couldn't prove it was him... I believe he's using ARD, or issuing commands by ssh to the remote computers.. is there any way to trace or log commands that have been issued to the computer?
Also, I would still love to know where to start with that notification script...
If anyone has any ideas how I can try to catch this guy, I'd love to hear them. Because as of right now I have no way to PROVE he's doing these things, though I know it's him.