How to track a user ?

[luciancali]

Hy !

I have a network with a domain controller and active directory users in one location
Also in other location i have different domain controller and active directory users, There are separate domains

My problem is that i have a person who manages to connect from one location to another

Each location that has domain controller and active directory has a firewall.....it's about fortigate machineThis person has only user account in active directory. Local accounts of his computer are disable.
On his computer the IP adress is static.Both server and workstations are up to date.

He succeeds using the Internet to connect to other network, using administrator privileges. 
This person makes changes on other computers both locations....normal changes that are made only by the network administrator.

I think it's a virus / trojan undetectable.I would like to know how can I scan servers, services from viruses / trojan undetectable and tracing how this persoon connect. From what I knew so far the user succeed to intervene over the user's session from a different computer without the user's knowledge or realizing and make any changes he wish

Any suggestion / feedback / opinion is appreciated...thank you

[nukecad]

You may want to consider getting one-to-one help from one of the dedicated virus/malware removal sites.

 

These guys are experts at helping you scan for and remove any nasties infecting your computer and/or network.

Once you start working with one you must follow their instructions and see the process through to the end.

 

Best of all they do it for free.

 

Here are links to a couple of the best of them, there are others, only use one at any time:

https://forums.malwarebytes.org/topic/9573-im-infected-what-do-i-do-now/

http://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-logs/