Weekly Activity Report

Apr 27 - May 03, 2026

Generated May 04, 2026 7:07 AM

18
Active Users
135
User Sessions
12
RDP Sessions
200
Failed Logons
17
Print Jobs
0
USB Events
0
Screenshots
70
Sysmon Events
60
Network Clients

User Activity (Domain Authentication)

DayUsersLogons
Mon, Apr 271064
Tue, Apr 2813200
Wed, Apr 291375
Thu, Apr 3013119
Fri, May 01953
Sat, May 0225
Sun, May 0300

Times show first/last authentication activity. Sessions = activity bursts separated by 30+ minute gaps.

UserSessionsFirst ActiveLast ActiveComputer / IP
MDM.283Mon 5:00 AMWed 10:56 AM192.168.2.11, DESIGNER-OFFICE
Hany Abdelmalek3Mon 7:34 AMWed 12:22 PMHANY-PC
Marian Alfons16Mon 7:48 AMFri 2:36 PM192.168.2.166, MARIAN-PC
David Mikhail27Mon 8:09 AMFri 2:22 PM192.168.128.3, 192.168.2.153, 535b081ed3ad
Atef Awad22Mon 8:46 AMSat 1:25 AMATEF-PC, 192.168.128.19
MDM.118Mon 8:51 AMFri 7:54 AM192.168.2.226, DESKTOP-SR790VT
Dalia Sidhom7Mon 9:02 AMFri 8:54 AM192.168.128.19, 192.168.128.61, DALIA
Mina Iscandar3Mon 9:47 AMThu 11:27 AM192.168.128.3, 535b081ed3ad, MDM-SERVER
Helena Awad9Mon 9:59 AMFri 11:01 AMDESIGNER-PC
Nervine Wassef6Mon 10:46 AMFri 1:58 PMNERVINE-PC
Ragy Awadallah7Tue 8:30 AMTue 3:39 PM192.168.128.6, ACCOUNTING
Karan7Tue 10:04 AMFri 11:20 AM192.168.2.127, KARAN-WAREHOUSE
Michael Guirguis2Tue 11:14 AMThu 5:26 PMEHAB-PC, 192.168.2.153
David Saad3Tue 12:38 PMThu 12:53 PM192.168.128.90
Meetings2Wed 11:06 AMThu 12:11 AM192.168.128.19
CodexSandboxOffline2Wed 2:17 PMSat 1:30 AMLocal
svc-openclaw1Wed 6:23 PMWed 6:23 PMmdm-openclaw
Ehab Kodsi7Thu 2:50 PMFri 9:31 PMEHAB-PC, MDM-SERVER

Remote Desktop Sessions (Guacamole / RDP)

UserSessionsFirstLastFrom
David Mikhail8Mon 8:09 AMFri 9:45 AM192.168.128.3
Mina Iscandar3Mon 9:47 AMThu 11:27 AM192.168.128.3
Karan1Thu 2:05 PMThu 2:05 PM192.168.2.127

Failed Logon Attempts

UserFailuresSource
hani@mdmcontracting.ca139HANY-PC
Fady Gorgy36FADY-ELECTRIC
David Mikhail14DESKTOP-ACDS751, DALIA-SALIB-PC
Michael Guirguis2EHAB-PC
David Saad2192.168.128.90
Atef Awad2192.168.128.19
Marian Alfons1192.168.2.166
Ragy Awadallah1192.168.128.6
Karan1192.168.2.127
Michael1MKG-BERTHA
Administrator1-

Machine/device auth failures (excluded from count): 4113 from XP600, MDM-SERVER

Top Applications (Server)

No application data for this period.

DNS Top Sites

ClientDomainQueries
192.168.2.226displaycatalog.mp.microsoft.com1
MDM-Server1096-ms-7.581-14e7af4.3ca41611-4358-11f1-919d-2cea7f579a3a1
MDM-Server1908-ms-7.95-499065.3e65729d-4358-11f1-919d-2cea7f579a3a1
MDM-Server1096-ms-7.776-1bc5880.3ca41611-4358-11f1-919d-2cea7f579a3a1
MDM-Server1908-ms-7.35-1bc957.3e65729d-4358-11f1-919d-2cea7f579a3a1
MDM-Server1096-ms-7.671-180dc5a.3ca41611-4358-11f1-919d-2cea7f579a3a1
192.168.128.161G-±32
EHAB-PClogin.microsoftonline.com120
MDM-Server1096-ms-7.719-19c4d41.3ca41611-4358-11f1-919d-2cea7f579a3a1
MDM-Server1908-ms-7.293-e534e1.3e65729d-4358-11f1-919d-2cea7f579a3a1
MDM-Servernetbird.mdmcontracting.ca2295
MDM-Server1096-ms-7.679-18569b2.3ca41611-4358-11f1-919d-2cea7f579a3a1
MDM-Server1096-ms-7.237-89a35a.3ca41611-4358-11f1-919d-2cea7f579a3a1
Hany-PCconfig.edge.skype.com20
MDM-Server1096-ms-7.728-1a0ecd9.3ca41611-4358-11f1-919d-2cea7f579a3a1
192.168.2.226ims-na1.adobelogin.com2
192.168.2.72seed.wavebrowser.co6
MDM-Server1096-ms-7.290-a530e1.3ca41611-4358-11f1-919d-2cea7f579a3a1
MDM-Server1096-ms-7.656-177b872.3ca41611-4358-11f1-919d-2cea7f579a3a1
MDM-Server1096-ms-7.157-5bdc6b.3ca41611-4358-11f1-919d-2cea7f579a3a1

Print Jobs

UserDocumentPrinterPagesTime
David MikhailPrint DocumentGuacamole Printer (redirected 5)1Fri 12:47 PM
David MikhailPrint DocumentGuacamole Printer (redirected 5)1Fri 12:47 PM
David MikhailPrint DocumentGuacamole Printer (redirected 5)1Fri 12:47 PM
David MikhailPrint DocumentGuacamole Printer (redirected 2)1Wed 1:59 PM
David MikhailPrint DocumentGuacamole Printer (redirected 2)1Wed 1:59 PM
David MikhailPrint DocumentGuacamole Printer (redirected 2)1Wed 1:59 PM
David MikhailPrint DocumentGuacamole Printer (redirected 26)1Tue 10:28 AM
David MikhailPrint DocumentGuacamole Printer (redirected 26)1Tue 10:25 AM
David MikhailPrint DocumentGuacamole Printer (redirected 26)1Tue 10:25 AM
David MikhailPrint DocumentGuacamole Printer (redirected 26)1Tue 10:22 AM
David MikhailPrint DocumentGuacamole Printer (redirected 26)1Tue 10:21 AM
David MikhailPrint DocumentGuacamole Printer (redirected 26)1Tue 10:16 AM
David MikhailPrint DocumentGuacamole Printer (redirected 26)1Tue 10:15 AM
David MikhailPrint DocumentGuacamole Printer (redirected 26)1Tue 10:13 AM
David MikhailPrint DocumentGuacamole Printer (redirected 26)1Tue 10:13 AM
David MikhailPrint DocumentGuacamole Printer (redirected 26)1Tue 10:10 AM
David MikhailPrint DocumentGuacamole Printer (redirected 25)1Mon 9:58 AM

Workstation Activity (Agent)

MDM-SERVER (Administrator) — 1 snapshots, avg idle: 0s

Top Window TitlesCount
Server Manager1
Top ProcessesSeen
cmd2
ServerManager1
WebPlugin_NVR1

KARAN-WAREHOUSE () — 1 snapshots, avg idle: 0s

Endpoint Deep Visibility (Sysmon)

Per-process command lines, network connections, and DNS from Sysmon on endpoints. 70 total events across 2 endpoint(s).

Administrator

ProcessDestinationPortCount
0:0:0:0:0:0:0:1135431
C:\Windows\System32\dns.exe192.168.128.61566661
C:\Windows\System32\dns.exe192.168.128.61629991
C:\Windows\System32\dns.exe192.168.128.61602461
C:\Windows\System32\dns.exe192.168.128.61555621
C:\Windows\System32\dns.exe192.168.128.61509661
C:\Windows\System32\dns.exe192.168.128.61496641
C:\Windows\System32\dns.exe192.168.128.61625331
C:\Program Files (x86)\winsim\ConnectionManager\MySqlBinary\5.7.27\mysql\mysqld.exe0:0:0:0:0:0:0:1135401
C:\Program Files (x86)\winsim\ConnectionManager\MySqlBinary\5.7.27\mysql\mysqld.exe0:0:0:0:0:0:0:1135411
C:\Windows\System32\dns.exe192.168.128.61643081
C:\Windows\System32\dns.exe192.168.128.61507461
C:\Windows\System32\dns.exe192.168.128.61604071
C:\Windows\System32\dns.exe192.168.128.61562141
C:\Windows\System32\dns.exe192.168.128.61524611
ProcessCommand LineParentCount
C:\Windows\System32\wsmprovhost.exeC:\Windows\system32\wsmprovhost.exe -EmbeddingC:\Windows\System32\svchost.exe1
C:\Windows\System32\dllhost.exeC:\Windows\system32\DllHost.exe /Processid:{133EAC4F-5891-4D04-BADA-D84870380A80}C:\Windows\System32\svchost.exe1
C:\Program Files (x86)\winsim\ConnectionManager\MySqlBinary\5.7.27\mysql\mysqladmin.exe"C:\Program Files (x86)\Winsim\ConnectionManager\MySqlBinary\5.7.27\mysql\mysqladmin.exe" --user=winsim --password=T...C:\Program Files (x86)\winsim\ConnectionManager\SimplyConnectionManager.exe1
C:\Windows\System32\fontdrvhost.exe"fontdrvhost.exe"C:\Windows\System32\winlogon.exe1
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -ExecutionPolicy Bypass "(Get-Content -Encoding UTF8 -Path C:\Users\ADMINI~1\AppData\Local\Temp\fyne-NetBi...C:\Program Files\Netbird\netbird-ui.exe1
C:\Windows\System32\rdpclip.exerdpclipC:\Windows\System32\svchost.exe1
C:\Program Files\Git\bin\bash.exe"C:\Program Files\Git\bin\bash.exe" -c "source /c/Users/Administrator/.claude/shell-snapshots/snapshot-bash-177764557...C:\Users\Administrator\.local\bin\claude.exe1
C:\Windows\System32\netsh.exenetsh advfirewall firewall add rule name=Netbird dir=in enable=yes action=allow profile=any localip=100.81.237.43C:\Program Files\Netbird\netbird.exe1
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File C:\Windows\SYSVO...C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1
C:\Windows\System32\LogonUI.exe"LogonUI.exe" /flags:0x2 /state0:0xa4031855 /state1:0x41c64e6dC:\Windows\System32\winlogon.exe1
ProcessDomainCount
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ActionsServer\ActionsServer.exemobile.events.data.microsoft.com1
crm.mdmgroupinc.ca1
D:\nodejs\node.execloudcode-pa.googleapis.com1
D:\nodejs\node.exeoauth2.googleapis.com1
D:\nodejs\node_modules\@openai\codex\node_modules\@openai\codex-win32-x64\vendor\x86_64-pc-windows-msvc\codex\codex.exechatgpt.com1
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ActionsServer\ActionsServer.exeecs.office.com1
C:\Program Files\Git\mingw64\bin\openssl.exem365-mcp.mdmgroupinc.ca1
C:\Program Files\Git\mingw64\bin\openssl.execrm.mdmgroupinc.ca1
mobile.events.data.microsoft.com1
D:\nodejs\node.exeplay.googleapis.com1

Network Traffic (Meraki)

ClientIPSent (MB)Received (MB)Total (MB)
dd808f66-c51f-4d19-8809-808c16ad5c81192.168.2.2261.46.88.2
bc:24:11:57:96:ad192.168.2.9900.10.1
Nervine-PC192.168.2.721.44.55.8
Android_OWOFYR1U192.168.2.2220.10.70.7
bc:24:11:4a:c0:1c192.168.2.370.10.10.1
CNC-PC-XP-600192.168.2.1260.10.20.2
e2af154d-7471-4303-8cad-503d12b52df7192.168.2.1970.50.81.3
c6:3f:e1:d5:90:71192.168.2.71000
bc:24:11:64:89:eb192.168.2.2400.10.1
bc:24:11:27:69:05192.168.2.290.30.81.2
bc:24:11:37:74:e5192.168.2.25000
bc:24:11:e3:39:cf192.168.2.354.30.44.7
bc:24:11:d9:11:fb192.168.2.21000
BB8836102192.168.2.73000
DGTL-iPhone192.168.2.199000

Microsoft 365 Activity

Microsoft's 7-day aggregate ending ~2 days ago (does not align exactly with the Mon–Sun report window). Sign-ins are real-time for the full week.

Email Activity (Last 7 Days)

UserSentReceivedReadLast Active
Mahmoud Assi711692512026-05-01
Mina Iscandar692344402026-05-02
Nervine Wassef433662732026-05-02
Dalia Sidhom2650992026-05-02
Atef Awad192092102026-05-02
Hani Abdelmalek151322222026-05-01
Helena Awad1140132026-05-01
David Mikhail1136462026-05-01
Marian Alfons10101452026-05-01
Ehab Guirguis94491122026-05-02
Fady Gorgy541382026-05-01
Ragy Awadallah523222026-04-28
Michael Guirguis2146452026-05-02
David Guirguis2117932026-05-01
Ehab Kodsi Guirguis1123232026-05-01
Prabhkaran Singh19132026-05-01
Meetings | MDM Group0102026-03-19
Mary Guirguis0502025-07-30
David Guirguis0102025-12-12
Mina Iscandar01502025-03-17

Teams Activity (Last 7 Days)

UserChatsCallsMeetingsLast Active
Dalia Sidhom6002026-05-02
Atef Awad4012026-05-01
Michael Guirguis3012026-04-29
Hani2002026-05-02
David Guirguis1012026-05-02
Minai0012026-04-30
Nervine0012026-05-02

Sign-In Activity

UserAppLocationStatusLast Time
Mina IscandarMicrosoft Azure CLICheyenne, USFailed (50053) (2x)May 02 8:45 PM
Ehab GuirguisSendMississauga, CAFailed (65001)Apr 30 3:51 PM
Info Desk | MDM WoodOffice 365 Exchange OnlineMoskva, RUFailed (50126) (4x)May 03 9:20 PM
Michael GuirguisFyxer AIToronto, CAFailed (65001) (3x)Apr 30 11:14 PM
David GuirguisTavily LoginMississauga, CAFailed (9010010)May 01 4:44 PM
Michael GuirguisMDM HubNorth York, CAFailed (50194) (3x)May 03 10:30 PM
Michael Guirguisclaude-mcpMississauga, CAFailed (65001) (6x)May 01 11:38 PM
Michael GuirguisMDM-WebsiteMississauga, CAFailed (50199) (2x)May 01 10:58 AM
Michael GuirguisMississauga, CAFailed (700016)May 01 10:28 AM
Ehab Kodsi GuirguisCloudflare AccessMississauga, CAFailed (501314)May 01 8:53 PM
Michael GuirguisMicrosoft Graph Command Line ToolsMississauga, CAFailed (65001) (2x)May 01 10:47 PM
Info Desk | MDM WoodOffice 365 Exchange OnlineTaliparamba, INFailed (50053) (6x)May 03 3:38 PM
Mina IscandarOne Outlook WebDEFailed (50053) (5x)May 03 3:52 PM
David GuirguisTavily LoginMississauga, CAFailed (65001)May 01 4:44 PM
Michael GuirguisMDM-WebsiteMississauga, CAFailed (500113)May 01 10:44 AM
Michael GuirguisMDM-WebsiteMississauga, CAFailed (65001)May 01 10:43 AM
Mina IscandarAzure Active Directory PowerShellLos Angeles, USFailed (50053)May 02 10:25 PM
Michael GuirguisCloudflare AccessMississauga, CAFailed (50140)May 01 7:44 PM
Michael GuirguisMicrosoft Graph Command Line ToolsMississauga, CAFailed (50199) (2x)May 01 10:55 PM
Michael GuirguisMicrosoft Graph Command Line ToolsMississauga, CASuccess (4x)May 01 10:55 PM
Ehab Kodsi GuirguisMDM HubMississauga, CASuccess (3x)May 01 9:03 PM
Mahmoud AssiOne Outlook WebToronto, CASuccess (6x)May 01 2:28 PM
Dalia SidhomSharePoint Online Web Client ExtensibilityMississauga, CASuccess (2x)May 01 3:00 PM
David GuirguisZapierMississauga, CASuccess (4x)May 01 4:52 PM
Dalia SidhomApp Home Pages ProdMississauga, CASuccess (2x)May 01 2:59 PM
David MikhailCloudflare AccessToronto, CASuccessMay 01 9:45 AM
Michael GuirguisCascade AuthenticationMississauga, CASuccessMay 01 1:28 PM
Ehab GuirguisCloudflare AccessMississauga, CASuccess (2x)May 03 12:33 PM
Mahmoud AssiOffice365 Shell WCSS-ClientToronto, CASuccess (2x)Apr 30 2:20 PM
Michael GuirguisMDM-WebsiteMississauga, CASuccess (2x)May 01 10:58 AM
Michael GuirguisCloudflare AccessMississauga, CASuccess (10x)May 03 1:02 PM
Mina IscandarCloudflare AccessMilton, CASuccessMay 01 11:30 PM
Ehab GuirguisOne Outlook WebMississauga, CASuccess (2x)May 01 1:29 PM
Michael GuirguisAzure PortalNorth York, CASuccess (11x)May 03 10:23 PM

File Access (Shared Drives)

No file access events recorded. Data will appear once users access audited shares.

Security Audit

Password Health
AccountPassword AgeStatus
MDM.111746d - STALENever expires
Hany Abdelmalek1741d - STALENever expires
MDM.261711d - STALENever expires
Nervine Wassef1711d - STALENever expires
Ehab Kodsi1707d - STALENever expires
Atef Awad1686d - STALENever expires
Administrator809d - STALENever expires
Michael Guirguis498d - STALENever expires
David Guirguis486d - STALENever expires
Mina Iscandar460d - STALENever expires
Karan432d - STALENever expires
Marian Alfons384d - STALENever expires
Dalia Sidhom318dNever expires
Fady303dNever expires
Meetings261dNever expires
David Mikhail188dNever expires
MDM.16143dNever expires
Shady Mikhail95dNever expires
Helena Awad86dNever expires
svc-openclaw46dNever expires
CodexSandboxOnline19dNever expires
CodexSandboxOffline19dNever expires
Inactive Accounts (90+ days)
AccountLast Login
Fady163d ago
MDM.16142d ago
CodexSandboxOnlineNever
Wiki Test WorkerNever
Wiki Test Mgr TelecomNever
Wiki Test AdminNever
System Health
Last Windows UpdateKB5075904 - 6d ago
Domain FirewallDISABLED
SMBv1Disabled (good)
C: Free Space12.7 GB
D: Free Space4728.6 GB
MDM-SERVER Monitoring • May 04, 2026 7:10 AM • MDM Contracting