If i delete an event from the event viewer, can the IT department still recover and find these deleted events?

Question

Usually, I cannot really install programs such as iTunes, Pc Suites, etc, however, I have been granted administrator rights for a limited period. I know they can trace whatever installations I may perform. Is there a way I can cover my trail?

Answer 1

You can remove items from the Event Viewer and they wont find out. However, a simple scan of your Program Files folder will reveal what you have installed. Additionally, if they look at the Add/Remove programs they can also see there.

There are several ways to cover your trail though, you can use TweakUI to remove the "Add/Remove" program from being listed there and also install your programs to a different folder.

Hope that helps.

Answer 2

It depends on where you work, and whether your IT dept. bothers with that kind of stuff, and usually they don't unless you've done something stupid.

Deleting something from the event viewer will not work because there is always the system log, and then there's the Network/Admin log. So depending on what kind of stuff you're installing, they may overlook/ignore it... But you can never completely cover your trail

Makes you feel like a spy eh? :D