Hi,
I recently noticed that a teamviewer remote session was made to a coputer of former It Staff that was terminated due to questionable server config revision that resulted to operation disruption.
After investigation, we found out that the employee was no longer happy with his job.
We have multiple servers with teamviewer access for support purposes, i change all of TV passwords except the former staff workstation as i'm not aware it has TV.
Is there a company who can investigate breaches like this to see the extent of the data breach?
I already change the password of TV and checking the TV log. It appears he started connecting around 8 days ago. Recent log shows its trying to install camera but this unit doesnt have one.
I am also thinking to restore the TV password and isolate the computer from the company LAN and see what will the remote connection session will do.
Please post possible actions i should or may do.
Thank you very much and more power to Spiceworks.
-Bernard