I want to keep a track who is changing the default gateway of any Client PC running Windows XP or Windows 7.
Is this in a log anywhere? If not, how can I track or log this event?
|show 5 more comments|
Here's what you do. If you have a small network, you build a small router system, using Linux if you want to do it on the cheap, and put it between your switch for your small network and your network connection. Essentially this becomes your gateway. Then on the router, you tell it that XYZ IP addresses go HERE, and ABC IP addresses go THERE, where HERE is filtered and THERE is not. Filter it by MAC if necessary. Then if they change their IP, they get...nothing. You can't rely on the machines to be properly filtered or set up; users can find a way around it if they have sufficient privileges and time, and they don't particularly like their job environment.
Second, you make sure this is all in your policies...you change the config of the system for non-work related purposes, you're fired. Make sure all employees are aware of this policy.
The Linux router solution (if you have a small network) also allows for filtering and monitoring of websites and such. It's relatively inexpensive. It's flexible. It can give you options for monitoring bandwidth and getting statistics on network use. But it takes some knowledge of how to use Linux and some decent hardware in the network card department so your connection is reliable.
The alternative is to configure your current "allow all" router connection to limit what IP's/machines are allowed to access it, forcing all other traffic through whatever you're using to filter.
You could write a script which checks the Gateway on computer startup and notifies you if it was changed from the default, or just reset it to the one you want