tracking desktop background changes?

Hi there

We've recently had an incident whereby a pupil logged onto his machine and up pops a rather provocative background.

The pupil in question insists that another boy logged on as his user and changed the background, however all server logon/logoff logs prove this not to be the case.

I have narrowed the window of when this was done to one lesson last week, it must have been done at the very end of the lesson, on the pupil in question's workstation however I have no proof, only evidence based on process of elimination.

I'm guessing there isn't any way to track when the desktop background was set?



.... as I'm writing this a moment of inspiration has just come to me, I'll go and check his local profile on the machine in question and see what the image timestamps say..


Worth a try -- any other suggestions greatly appreciated!

Thanks

Update: That worked!

Got the date and time the screen shot was set (it was a right click from internet explorer jobby), down to the end of the lesson last week.

Time for some pupil-grilling.

Maybe it's time to change to mandatory roaming profiles?