Log entry if RAM is removed?

[pete]

I think (and a few google searches seem to suggest) that windows doesn't record when a stick of ram is added to or removed from a machine.

 

Unless someone here knows otherwise?

 

Cheers

 

Pete

[Geoff]

I think you can get the information from WMI on how many sticks are in the machine. If you record this information at bootup (say in a database) that'd get you what you want.

[pete]

Thanks - will look into that. We currently run psinfo to grab data every so often, but a daily script on boot would give us better data for sleuthing purposes.

 

Unfortunately, the horse has bolted - this is for the next time some little XXXX nicks RAM.

[mac_shinobi]

Sysinternals @ http://www.sysinternals.com do a neat little utility called bginfo

which will display info like that on the desktops background for ya

 

If that does not help you could either use scriptomatic 2.0 to help you with the vbscript using wmi to attain the info and get the vbscript to append to the same text file on a network share or shared drive or something to that extent so that you get something like so :

 

machine name ---> xxxMb of memory installed

 

or what ever output you want, depends what output you are looking for exactly.

 

If you want I could help you later on with wmi and vbscript

[mac_shinobi]

Here is the URL for bginfo :

 

http://www.sysinternals.com/utilities/bginfo.html

[mac_shinobi]

Did a quick search on google and this looks like something that may be of interest to you

 

http://www.majorgeeks.com/CS_Fire_Monitor_d4243.html

[pete]

Here is the URL for bginfo :

 

http://www.sysinternals.com/utilities/bginfo.html

 

Yeah, we're thinking of using that for an "things thou shalt include in any error reports" instructions.

 

Thanks for all the suggestions, perhaps I should have clarified my question earlier...

 

Some kids have stolen RAM from 3 machines. We know when we last checked for memory tallies in the room and we'll be doing that more regularly through a startup script using some / all of the idea mentioned upthread.

 

What I was looking for (but didn't really expect to find) was a pre-existing log or text file somewhere in which Windows had mentioned "I appear to have less / more RAM than the last time I booted up", so I could narrow down the timeframe when I wade through CCTV footage.

 

It seems that without us pre-empting the possibility (and setting up a monitoring script / program of some sort), it doesn't record it.

 

Cheers.

 

Pete

[mac_shinobi]

The only way or thing I can think of with regards to that would be when you install XP doesnt it use HAL to see what hardware you have installed etc, so it makes me wonder, doesnt it store any info like that in WINNT.inf or anything like that ? Just a thought.

[MkII]

Like the look of CSFire gecko

[russdev]

Here is the URL for bginfo :

 

http://www.sysinternals.com/utilities/bginfo.html

 

Yeah, we're thinking of using that for an "things thou shalt include in any error reports" instructions.

 

Thanks for all the suggestions, perhaps I should have clarified my question earlier...

 

Some kids have stolen RAM from 3 machines. We know when we last checked for memory tallies in the room and we'll be doing that more regularly through a startup script using some / all of the idea mentioned upthread.

 

What I was looking for (but didn't really expect to find) was a pre-existing log or text file somewhere in which Windows had mentioned "I appear to have less / more RAM than the last time I booted up", so I could narrow down the timeframe when I wade through CCTV footage.

 

It seems that without us pre-empting the possibility (and setting up a monitoring script / program of some sort), it doesn't record it.

 

Cheers.

 

Pete

 

but how did no one notice kids with leads open on pcs

 

russ

[mac_shinobi]

I didnt know sticks of ram included leads, its just a case of pushing a clip down on either side of the stick of ram to make the memory module pop out and then you pull it out slip the case back on and bingo.

 

Not that ive stolen ram before but I have inserted and taken ram out of a machine before ( which also includes building my own machines )

[MkII]

lids - lids!!!

[MkII]

That's the thing isn't it Russ. Happened here recently - poor old science tech was blamed for not securing the room well enough. Dunno how the hell it happened - have my suspicions.

These PC's of mine only have 1 stick of ram - so you could get the last time it was accessed if the culprits had to down the PC to remove the ram.

 

What about using AIDA32 network version? I had that set up to take an audit at every boot up [quite a simple thing to do - nothing has to be installed on the clients either] - was unnoticeable performance wise, runs silently of course, and gives a nice thorough set of stats.

[kingswood]

I didnt know sticks of ram included leads, its just a case of pushing a clip down on either side of the stick of ram to make the memory module pop out and then you pull it out slip the case back on and bingo.

 

Not that ive stolen ram before but I have inserted and taken ram out of a machine before ( which also includes building my own machines )

 

LOL!

 

Yeah. Erm. LIDS as the man said. I would think Russ would know RAM doesn't have leads. Aherm.

 

:oops:

 

Paul

[TimH]

Not sure what the etiquette/protocol is for sending code snippets but here is a small part of our machine inventory script which is run every time a machine boots.

 

The full version records the details we want - HD size/space, motherboard type/ processor /installed apps (in uninstall reg) etc.. It records results as simple text files in 2 folders (hardware/software) on a server and I have a viewer that lets us monitor the results.

 

Can't remember the reason for the size check in the script - I assume I got spurious results when testing it, oh and we have a small number of machines which lie - they should have 256Mb RAM but show up by this as 64/128Mb and via GUI machine properties 192Mb !

 

You could easily make it keep track of RAM size in a text file/reg and if changed then notify.

 

Tim

ramcheck.vbs

[Geoff]

oh and we have a small number of machines which lie - they should have 256Mb RAM but show up by this as 64/128Mb and via GUI machine properties 192Mb

 

That'd be the onboard video using part of the system ram for its own purposes. Look on the BIOS bootup screen for 'shared memory' and in the bios for 'AGP apature size'.

[TimH]

That'd be the onboard video using part of the system ram for its own purposes. Look on the BIOS bootup screen for 'shared memory' and in the bios for 'AGP apature size'.

 

Not sure, just checked, these machines have "real" graphics card, others I've checked with onboard, still report the full RAM size. Unfortunately I can't get to the BIOS screens from here ! - will have a look next week.

[pete]

but how did no one notice kids with leads open on pcs

russ

 

That's what I'm wondering. The room shares a window with a deputy heads office and she's quite ..... dedicated when it comes to keeping an eye on them.

 

However, it's a 6th form only computer room dedicated to private study - they're not actively supervised. SMT and I believed we could trust them and last years 6th form were trustworthy and didn't abuse the privilege.

 

After last week (and a couple of other incidents), we've concluded that this years L6 aren't to be trusted. I'm going to give the room a nice new CCTV camera.

[Geoff]

Better to be safe than sorry I suppose.

[MkII]

We terminated 6th form private access here too after some nasty trashings.

[Sirbendy]

We've had kids nick RAM before...however, I knew it was Year 11..so I waited for the next Y11 Assembly and addressed them re: "the pros and cons of upsetting the IT department", and specifically why they didn't want to push their luck.

 

The RAM turned up outside my door 20 minutes later..the CPU that went missing at the same time was found experimenting with water cooling in a puddle...

[john]

I am about to do a similar thing on nicking my optical mice, I think the cable ties are going to have to be used on the leads. We had hoped that it would not be needed, but after we have had 4 mice nicked, two swapped for non-optical from Optical and one having its lead ripped out, I think I need to do the threat - If you keep nicking / damaging the mice then we will put the old mankey White, none-scrolling, ball mice that are like 99p each, and remove all the nice Logitech Optical Mice and give them to the well behaved Admin Staff, and the kids can have the nasty ones. The little kiddies love them and behave well with them, as well as the staff, but the middleage kids just don't respect them.