Daily Activity Report

Sunday, May 31, 2026 (through 6:00 PM)

Generated May 31, 2026 6:06 PM

1
Active Users
1
User Sessions
0
RDP Sessions
9
Failed Logons
0
Print Jobs
0
USB Events
0
Screenshots
116
Sysmon Events
33
Network Clients

User Activity (Domain Authentication)

Times show first/last authentication activity. Sessions = activity bursts separated by 30+ minute gaps.

UserSessionsFirst ActiveLast ActiveComputer / IP
Michael Guirguis15:44 PM5:44 PM192.168.2.61

Remote Desktop Sessions (Guacamole / RDP)

No RDS sessions recorded for this period.

Failed Logon Attempts

UserFailuresSource
hani@mdmcontracting.ca7HANY-PC
michael.guirguis@mdmgroupinc.ca2MKG-BERTHA

Top Applications (Server)

No application data for this period.

DNS Top Sites

ClientDomainQueries
192.168.2.115d2e67ae7fd1cb7c37b50619688595de.res-smartsnd.info1
192.168.2.226crl3.digicert.com4
Hany-PCarray613.prod.do.dsp.mp.microsoft.com15
192.168.2.72teams-ring-fallback.msedge.net1
Localgraph.microsoft.com10
192.168.2.72d.dropbox.com12
MDM-Server1096-ms-7.489-117984b.5464da91-5c7e-11f1-989d-2cea7f579a3a1
MDM-Server1096-ms-7.548-137a158.5464da91-5c7e-11f1-989d-2cea7f579a3a1
MDM-Server1876-ms-7.413-140d702.561f9b71-5c7e-11f1-989d-2cea7f579a3a1
MDM-Server1096-ms-7.789-1c580dc.5464da91-5c7e-11f1-989d-2cea7f579a3a1
MDM-Server1876-ms-7.551-1aea0e7.561f9b71-5c7e-11f1-989d-2cea7f579a3a1
MDM-Server1096-ms-7.839-1e10403.5464da91-5c7e-11f1-989d-2cea7f579a3a1
MDM-Server1096-ms-7.738-1a58b29.5464da91-5c7e-11f1-989d-2cea7f579a3a1
MDM-Server1096-ms-7.473-10e6ffe.5464da91-5c7e-11f1-989d-2cea7f579a3a1
192.168.128.24cfd-features.argotunnel.com4
192.168.2.72bolt.dropbox.com8
MDM-Server1096-ms-7.683-1857366.5464da91-5c7e-11f1-989d-2cea7f579a3a1
MDM-Server1876-ms-7.518-1933540.561f9b71-5c7e-11f1-989d-2cea7f579a3a1
Hany-PCself.events.data.microsoft.com12
192.168.2.72exo.nel.measure.office.net1

Workstation Activity (Agent)

MDM-SERVER (Administrator) — 2 snapshots, avg idle: 0s

Top Window TitlesCount
Server Manager2
Top ProcessesSeen
cmd4
ServerManager2
WebPlugin_NVR2

HANY-PC () — 1 snapshots, avg idle: 0s

PC-19 () — 1 snapshots, avg idle: 0s

NERVINE-PC () — 1 snapshots, avg idle: 0s

DESIGNER-OFFICE () — 1 snapshots, avg idle: 0s

DESKTOP-SR790VT () — 1 snapshots, avg idle: 0s

Endpoint Deep Visibility (Sysmon)

Per-process command lines, network connections, and DNS from Sysmon on endpoints. 116 total events across 6 endpoint(s).

Administrator

ProcessDestinationPortCount
D:\nodejs\node.exe0:0:0:0:0:0:0:130002
C:\Users\Administrator\.local\bin\claude.exe160.79.104.104431
System172.178.160.261371
C:\Windows\System32\dns.exe0:0:0:0:0:0:0:1645001
C:\Program Files (x86)\cloudflared\cloudflared.exe198.41.192.5778442
C:\Program Files\Git\usr\bin\ssh.exe192.168.2.30221
C:\Windows\System32\dns.exe192.168.128.24338591
C:\Windows\System32\dns.exe192.168.128.102605401
C:\Windows\System32\dns.exe192.168.2.226564691
C:\Program Files\Google\Chrome\Application\chrome.exe224.0.0.25153531
C:\Program Files\Google\Chrome\Application\chrome.exe192.168.128.10253531
C:\Windows\System32\dns.exe192.168.128.102610601
C:\Windows\System32\dns.exe192.168.2.226512581
C:\Windows\System32\dns.exe192.168.2.226544621
C:\Program Files\Netbird\netbird.exe192.168.2.3518202
ProcessCommand LineParentCount
C:\Program Files\Git\usr\bin\bash.exe"C:\Program Files\Git\usr\bin\bash.exe" /c/Users/Administrator/.claude/plugins/cache/claude-plugins-official/security...C:\Program Files\Git\usr\bin\bash.exe1
C:\Windows\System32\wsmprovhost.exeC:\Windows\system32\wsmprovhost.exe -EmbeddingC:\Windows\System32\svchost.exe1
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Command "(Get-ScheduledTask -TaskName 'MDM-Dail...C:\Program Files\Git\usr\bin\bash.exe1
C:\Program Files\Git\usr\bin\cat.exe"C:\Program Files\Git\usr\bin\cat.exe" //MDM-SERVER/SYSVOL/MDM.local/Policies/{A1E46CA8-2950-467D-BF36-D3A313A68B1C}/...C:\Program Files\Git\usr\bin\bash.exe1
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteracti...C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1
C:\Program Files\Git\usr\bin\ls.exe"C:\Program Files\Git\usr\bin\ls.exe" -la //MDM-SERVER/SYSVOL/MDM.local/Policies/{A1E46CA8-2950-467D-BF36-D3A313A68B1...C:\Program Files\Git\usr\bin\bash.exe1
C:\Program Files\Git\usr\bin\ssh.exe"C:\Program Files\Git\usr\bin\ssh.exe" -i C:\Users\Administrator\.ssh\id_ed25519 -o UserKnownHostsFile=C:\Users\Admin...C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1
C:\Windows\System32\fsutil.exe"C:\Windows\system32\fsutil.exe" hardlink list D:\Scripts\Reporting\tenant-monitor-report.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1
C:\Windows\System32\dllhost.exeC:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}C:\Windows\System32\svchost.exe1
C:\Program Files\Git\usr\bin\bash.exe"C:\Program Files\Git\bin\..\usr\bin\bash.exe" -c "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/posttooluse.py"C:\Program Files\Git\bin\bash.exe2
ProcessDomainCount
github.com2
C:\Program Files\Microsoft OneDrive\26.084.0504.0007\OneDrive.Sync.Service.exemobile.events.data.microsoft.com2
C:\Windows\System32\wbem\WmiPrvSE.exeDESIGNER-PC1
C:\Program Files\Microsoft OneDrive\OneDrive.exeself.events.data.microsoft.com2
D:\nodejs\node_modules\@openai\codex\node_modules\@openai\codex-win32-x64\vendor\x86_64-pc-windows-msvc\codex\codex.exechatgpt.com2
C:\Program Files\Google\Chrome\Application\chrome.exesafebrowsing.googleapis.com2
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeDESIGNER-OFFICE1
C:\Program Files\Google\Chrome\Application\chrome.execlientservices.googleapis.com2
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMDM-SERVER1
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeapi.telegram.org1

Network Traffic (Meraki)

ClientIPSent (MB)Received (MB)Total (MB)
14:2f:fd:0d:d3:0d192.168.2.64000
b0:7b:25:17:b6:e2192.168.2.30.10.10.2
c0:74:ad:1b:b1:db192.168.2.94000
bc:24:11:97:31:09192.168.2.39000
bc:24:11:48:6a:35192.168.2.40000
bc:24:11:6d:df:90192.168.2.40000
bc:24:11:4a:c0:1c192.168.2.37000
cdbdad29-9543-4261-b5a9-97e7e7ec301c192.168.2.2260.10.30.3
bc:24:11:4d:e6:c6192.168.2.27000
Designer-Office192.168.2.11000
bc:24:11:43:eb:d9192.168.2.22000
bc:24:11:00:12:f1192.168.2.34000
BB8836154192.168.2.124000
bc:24:11:72:d7:7c192.168.2.33000
bc:24:11:46:32:87192.168.2.4100.70.7

Microsoft 365 Activity

Email & Teams data is from May 30 (yesterday — Microsoft reports have a ~24h processing delay). Sign-ins are real-time.

Email Activity (May 30)

UserSentReceivedReadLast Active
Ehab Guirguis243682026-05-30
Michael Guirguis334912026-05-30
David Guirguis0212026-05-30
Nervine Wassef01902026-05-29
Dalia Sidhom0112026-05-30
Atef Awad0512026-05-30
Helena Awad0102026-05-28
Ehab Kodsi Guirguis0702026-05-29
Hani Abdelmalek0402026-05-29
Mina Iscandar0512026-05-30
Mahmoud Assi0102026-05-29
Mina Iscandar0402025-03-17

Sign-In Activity

UserAppLocationStatusLast Time
Info Desk | MDM WoodOffice 365 Exchange OnlinePerugia, ITFailed (50053) (2x)May 31 12:23 PM
Mina IscandarOfficeHomeBroadway, GBFailed (50126)May 31 6:01 AM
David GuirguisCascade AuthenticationMississauga, CASuccessMay 31 2:55 PM
Michael GuirguisSharePoint Online Web Client ExtensibilityMississauga, CASuccessMay 31 3:15 PM
Michael GuirguisMicrosoft Office 365 PortalMississauga, CASuccessMay 31 2:55 PM
Ehab GuirguisOffice365 Shell WCSS-ClientMississauga, CASuccessMay 31 1:08 PM
Ehab GuirguisOffice 365 SharePoint OnlineMississauga, CASuccessMay 31 1:08 PM
Michael GuirguisOffice365 Shell WCSS-ClientMississauga, CASuccess (2x)May 31 2:56 PM
Michael GuirguisOffice 365 SharePoint OnlineMississauga, CASuccess (2x)May 31 2:56 PM
Ehab GuirguisSharePoint Online Web Client ExtensibilityMississauga, CASuccessMay 31 1:08 PM

File Access (Shared Drives)

No file access events recorded. Data will appear once users access audited shares.

MDM-SERVER Monitoring • May 31, 2026 6:07 PM • MDM Contracting