Log entry if RAM is removed?

I think (and a few google searches seem to suggest) that windows doesn't record when a stick of ram is added to or removed from a machine.

Unless someone here knows otherwise?

Cheers

Pete

I think you can get the information from WMI on how many sticks are in the machine. If you record this information at bootup (say in a database) that'd get you what you want.

Thanks - will look into that. We currently run psinfo to grab data every so often, but a daily script on boot would give us better data for sleuthing purposes.

Unfortunately, the horse has bolted - this is for the next time some little XXXX nicks RAM.

Sysinternals @ www.sysinternals.com do a neat little utility called bginfo
which will display info like that on the desktops background for ya ;)

If that does not help you could either use scriptomatic 2.0 to help you with the vbscript using wmi to attain the info and get the vbscript to append to the same text file on a network share or shared drive or something to that extent so that you get something like so :

machine name ---> xxxMb of memory installed

or what ever output you want, depends what output you are looking for exactly.

If you want I could help you later on with wmi and vbscript :)

Here is the URL for bginfo :

http://www.sysinternals.com/utilities/bginfo.html

Did a quick search on google and this looks like something that may be of interest to you :)

http://www.majorgeeks.com/CS_Fire_Monitor_d4243.html

Quote:

---

Originally Posted by gecko

Here is the URL for bginfo :

http://www.sysinternals.com/utilities/bginfo.html

---

Yeah, we're thinking of using that for an "things thou shalt include in any error reports" instructions.

Thanks for all the suggestions, perhaps I should have clarified my question earlier...

Some kids have stolen RAM from 3 machines. We know when we last checked for memory tallies in the room and we'll be doing that more regularly through a startup script using some / all of the idea mentioned upthread.

What I was looking for (but didn't really expect to find) was a pre-existing log or text file somewhere in which Windows had mentioned "I appear to have less / more RAM than the last time I booted up", so I could narrow down the timeframe when I wade through CCTV footage.

It seems that without us pre-empting the possibility (and setting up a monitoring script / program of some sort), it doesn't record it.

Cheers.

Pete

The only way or thing I can think of with regards to that would be when you install XP doesnt it use HAL to see what hardware you have installed etc, so it makes me wonder, doesnt it store any info like that in WINNT.inf or anything like that ? Just a thought.

Like the look of CSFire gecko

Quote:

---

Originally Posted by pete

Quote:

---

Originally Posted by gecko

Here is the URL for bginfo :

http://www.sysinternals.com/utilities/bginfo.html

---

Yeah, we're thinking of using that for an "things thou shalt include in any error reports" instructions.

Thanks for all the suggestions, perhaps I should have clarified my question earlier...

Some kids have stolen RAM from 3 machines. We know when we last checked for memory tallies in the room and we'll be doing that more regularly through a startup script using some / all of the idea mentioned upthread.

What I was looking for (but didn't really expect to find) was a pre-existing log or text file somewhere in which Windows had mentioned "I appear to have less / more RAM than the last time I booted up", so I could narrow down the timeframe when I wade through CCTV footage.

It seems that without us pre-empting the possibility (and setting up a monitoring script / program of some sort), it doesn't record it.

Cheers.

Pete

---

but how did no one notice kids with leads open on pcs

russ

I didnt know sticks of ram included leads, its just a case of pushing a clip down on either side of the stick of ram to make the memory module pop out and then you pull it out slip the case back on and bingo.

Not that ive stolen ram before but I have inserted and taken ram out of a machine before ( which also includes building my own machines )

lids - lids!!!

That's the thing isn't it Russ. Happened here recently - poor old science tech was blamed for not securing the room well enough. Dunno how the hell it happened - have my suspicions.
These PC's of mine only have 1 stick of ram - so you could get the last time it was accessed if the culprits had to down the PC to remove the ram.

What about using AIDA32 network version? I had that set up to take an audit at every boot up [quite a simple thing to do - nothing has to be installed on the clients either] - was unnoticeable performance wise, runs silently of course, and gives a nice thorough set of stats.

Quote:

---

Originally Posted by gecko

I didnt know sticks of ram included leads, its just a case of pushing a clip down on either side of the stick of ram to make the memory module pop out and then you pull it out slip the case back on and bingo.

Not that ive stolen ram before but I have inserted and taken ram out of a machine before ( which also includes building my own machines )

---

LOL!

Yeah. Erm. LIDS as the man said. I would think Russ would know RAM doesn't have leads. Aherm.

:oops:

Paul

Not sure what the etiquette/protocol is for sending code snippets but here is a small part of our machine inventory script which is run every time a machine boots.

The full version records the details we want - HD size/space, motherboard type/ processor /installed apps (in uninstall reg) etc.. It records results as simple text files in 2 folders (hardware/software) on a server and I have a viewer that lets us monitor the results.

Can't remember the reason for the size check in the script - I assume I got spurious results when testing it, oh and we have a small number of machines which lie - they should have 256Mb RAM but show up by this as 64/128Mb and via GUI machine properties 192Mb !

You could easily make it keep track of RAM size in a text file/reg and if changed then notify.

Tim