In one of our production environments we discovered that my account apparently made a change to a TI process in one of the TM1 instances. This change hasn't actually been made by me at all (I know cause I would have had to do it
but the audit log says I made the change..... A few specifics:
The Admin host is a 2008 server that is also a remote desktop services server (terminal server) that the developers can logon to if need be.
There is a Dev admin host (same spec etc) that the devs normally logon to and then point their architect/perspectives to whatever admin host they're interested in.
My question is how can the audit log be manipulated (assuming that someone has not guessed my password and actually logged on as me) or are there other ways in which someone can deliberately impersonate another user? Or are there instances, perhaps in terminal server environments, where the usernames could be getting mixed up?
(for example, opening an excel workbook on the terminal server will often show the server admins username, even though you know its a colleague next to you who has it open)
Any ideas are welcome, thanks.