Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to keep a track who is changing the default gateway of any Client PC running Windows XP or Windows 7.

Is this in a log anywhere? If not, how can I track or log this event?

share|improve this question
1  
Your accepted question rate is terrible. I suggest going back through your old, answered questions and seeing if any of the answers solved your problem. If they did, you should accept them. Having a low accept rate will keep people from wanting to help you in the future. –  MDMarra Jul 2 '12 at 15:58
    
What would they gain by doing this in your network? Wouldn't it just break their donnection? –  Zoredache Jul 2 '12 at 15:58
4  
@Zoredache if it's anything like some small networks I've seen, sometimes there's a proxy or filter that is set up and everyone gets this connection, and there's a non-filtered connection used as a gateway also available, so manually changing them lets you choose which to go through. Security and protection through obscurity... –  Bart Silverstrim Jul 2 '12 at 16:00
4  
Well, what about configuring that gateway to only allow connections from specific IP addresses? Oh, yeah, that would require someone to actually know what he's doing... –  Massimo Jul 2 '12 at 16:03
1  
@Dan - no argument there, I was just outlining a scenario where I've seen this happen before. Organic networks seem to grow into this kind of problem until it's time to upgrade from garden to greenhouse and the management is hesitant to go through that kind of cost...so they look for creative solutions within the framework of what they already know. –  Bart Silverstrim Jul 2 '12 at 16:29

2 Answers 2

Here's what you do. If you have a small network, you build a small router system, using Linux if you want to do it on the cheap, and put it between your switch for your small network and your network connection. Essentially this becomes your gateway. Then on the router, you tell it that XYZ IP addresses go HERE, and ABC IP addresses go THERE, where HERE is filtered and THERE is not. Filter it by MAC if necessary. Then if they change their IP, they get...nothing. You can't rely on the machines to be properly filtered or set up; users can find a way around it if they have sufficient privileges and time, and they don't particularly like their job environment.

Second, you make sure this is all in your policies...you change the config of the system for non-work related purposes, you're fired. Make sure all employees are aware of this policy.

The Linux router solution (if you have a small network) also allows for filtering and monitoring of websites and such. It's relatively inexpensive. It's flexible. It can give you options for monitoring bandwidth and getting statistics on network use. But it takes some knowledge of how to use Linux and some decent hardware in the network card department so your connection is reliable.

The alternative is to configure your current "allow all" router connection to limit what IP's/machines are allowed to access it, forcing all other traffic through whatever you're using to filter.

share|improve this answer
    
If you want to make it really simple check out ClearOS, its a free SMB gateway, router: clearfoundation.com –  Brent Pabst Jul 2 '12 at 16:50

You could write a script which checks the Gateway on computer startup and notifies you if it was changed from the default, or just reset it to the one you want

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.