Trace source of WOL packets

[neonetman]

I am coming in every morning and finding all our PCs' on in school. As far as I was aware there was no WOL setup, however I'm feeling there must be. Is there an easy way of monitoring for a WOL packet and identifying its' source

?

[bald_pig]

Set up wireshark and filter for WOL

[bknaggs]

Check there is no scheduled startup in the BIOS as well.

[mavhc]

do they all start at the same time? systeminfo will give you boot time.

[Rob_D]

Personally, I'd start by hunting through the server shares and netlogon for a WOL script. It might help narrow things down. (I find these things normally wind up on the PDC)