Weekly Activity Report

May 25 - May 31, 2026

Generated Jun 01, 2026 7:08 AM

15
Active Users
108
User Sessions
6
RDP Sessions
654
Failed Logons
11
Print Jobs
0
USB Events
0
Screenshots
116
Sysmon Events
58
Network Clients

User Activity (Domain Authentication)

DayUsersLogons
Mon, May 25993
Tue, May 2612133
Wed, May 27648
Thu, May 289260
Fri, May 29623
Sat, May 3039
Sun, May 3112

Times show first/last authentication activity. Sessions = activity bursts separated by 30+ minute gaps.

UserSessionsFirst ActiveLast ActiveComputer / IP
Marian Alfons18Mon 7:39 AMFri 7:34 AM192.168.2.166, MARIAN-PC
MDM.117Mon 8:04 AMFri 9:43 AM192.168.2.226, DESKTOP-SR790VT
Dalia Sidhom6Mon 8:54 AMFri 9:02 AM192.168.128.61, DALIA
David Mikhail22Mon 9:27 AMThu 3:39 PM192.168.128.3, 192.168.2.153, 13e264c4d21f
Atef Awad7Mon 9:51 AMThu 10:43 AM192.168.128.60
Nervine Wassef7Mon 11:03 AMThu 2:05 PM192.168.2.3, 192.168.2.72
Helena Awad6Mon 11:11 AMThu 5:08 PMDESIGNER-PC
MDM.261Mon 11:35 AMMon 11:36 AM192.168.2.153
Michael Guirguis7Mon 5:41 PMSun 5:44 PM192.168.2.61
Karan13Tue 7:47 AMFri 2:53 PM192.168.2.127, KARAN-WAREHOUSE
Hany Abdelmalek3Tue 8:33 AMSat 7:48 PMHANY-PC
Mina Iscandar2Tue 10:30 AMTue 12:27 PM192.168.128.3, 13e264c4d21f, MDM-SERVER
David Saad3Tue 12:32 PMFri 12:39 PM192.168.128.90
Ragy Awadallah5Thu 8:29 AMThu 3:00 PM192.168.128.6, ACCOUNTING
CodexSandboxOffline1Sat 5:56 PMSat 5:56 PMLocal

Remote Desktop Sessions (Guacamole / RDP)

UserSessionsFirstLastFrom
David Mikhail5Mon 1:37 PMThu 2:52 PM192.168.128.3
Mina Iscandar1Tue 10:30 AMTue 10:30 AM192.168.128.3

Failed Logon Attempts

UserFailuresSource
MDM.28438DESIGNER-OFFICE
hani@mdmcontracting.ca143HANY-PC
Fady Gorgy20FADY-ELECTRIC
Gues14DALIA-SALIB-PC
svc-openclaw14mdm-openclaw
Mina Iscandar12DESKTOP-MSD5M51
MDM.264192.168.2.153
Atef Awad2192.168.128.60
michael.guirguis@mdmgroupinc.ca2MKG-BERTHA
Administrator2-
David Mikhail1192.168.2.153
David Saad1192.168.128.90
Karan1192.168.2.127

Machine/device auth failures (excluded from count): 3093 from XP600

Top Applications (Server)

No application data for this period.

DNS Top Sites

ClientDomainQueries
MDM-Server1096-ms-7.669-180e226.5464da91-5c7e-11f1-989d-2cea7f579a3a1
MDM-Server1096-ms-7.804-1ca23d0.5464da91-5c7e-11f1-989d-2cea7f579a3a1
MDM-Serverhis-sb-hisgeneral-nam-eus1.servicebus.windows.net1
MDM-Server1096-ms-7.495-11c20b1.5464da91-5c7e-11f1-989d-2cea7f579a3a1
192.168.2.72onedriveclucprodbn20007.blob.core.windows.net1
MDM-Server1096-ms-7.427-f2f7d4.5464da91-5c7e-11f1-989d-2cea7f579a3a1
192.168.2.72edge.microsoft.com13
MDM-Server1096-ms-7.679-1856a4e.5464da91-5c7e-11f1-989d-2cea7f579a3a1
MDM-Server1096-ms-7.488-1178cd1.5464da91-5c7e-11f1-989d-2cea7f579a3a1
MDM-Serverctldl.windowsupdate.com14
MDM-Server1096-ms-7.727-1a0e1bd.5464da91-5c7e-11f1-989d-2cea7f579a3a1
MDM-Server1096-ms-7.375-d781dc.5464da91-5c7e-11f1-989d-2cea7f579a3a1
MDM-Server1096-ms-7.388-dc1157.5464da91-5c7e-11f1-989d-2cea7f579a3a1
MDM-Server1096-ms-7.764-1b3436d.5464da91-5c7e-11f1-989d-2cea7f579a3a1
MDM-Server1096-ms-7.149-574a8e.5464da91-5c7e-11f1-989d-2cea7f579a3a1
MDM-Server1096-ms-7.370-d2edbd.5464da91-5c7e-11f1-989d-2cea7f579a3a1
MDM-Server1096-ms-7.744-1aa140c.5464da91-5c7e-11f1-989d-2cea7f579a3a1
MDM-Server1096-ms-7.698-18e9bb3.5464da91-5c7e-11f1-989d-2cea7f579a3a1
MDM-Server1096-ms-7.790-1c580dc.5464da91-5c7e-11f1-989d-2cea7f579a3a1
MDM-Server1096-ms-7.322-b77e2e.5464da91-5c7e-11f1-989d-2cea7f579a3a1

Print Jobs

UserDocumentPrinterPagesTime
David MikhailPrint DocumentGuacamole Printer (redirected 5)1Thu 2:54 PM
David MikhailPrint DocumentGuacamole Printer (redirected 4)1Tue 11:33 AM
David MikhailPrint DocumentGuacamole Printer (redirected 4)1Tue 11:22 AM
David MikhailPrint DocumentGuacamole Printer (redirected 4)2Tue 11:22 AM
David MikhailPrint DocumentGuacamole Printer (redirected 4)1Tue 11:21 AM
David MikhailPrint DocumentGuacamole Printer (redirected 4)1Tue 11:21 AM
David MikhailPrint DocumentGuacamole Printer (redirected 4)1Tue 11:20 AM
David MikhailPrint DocumentGuacamole Printer (redirected 4)1Tue 11:20 AM
David MikhailPrint DocumentGuacamole Printer (redirected 4)1Tue 11:20 AM
David MikhailPrint DocumentGuacamole Printer (redirected 4)1Tue 11:19 AM
David MikhailPrint DocumentGuacamole Printer (redirected 4)1Tue 11:19 AM

Workstation Activity (Agent)

MDM-SERVER (Administrator) — 2 snapshots, avg idle: 0s

Top Window TitlesCount
Server Manager2
Top ProcessesSeen
cmd4
ServerManager2
WebPlugin_NVR2

KARAN-WAREHOUSE () — 1 snapshots, avg idle: 0s

DALIA-SALIB-PC () — 1 snapshots, avg idle: 0s

EHAB-PC () — 1 snapshots, avg idle: 0s

ATEF-PC () — 1 snapshots, avg idle: 0s

PC-19 () — 1 snapshots, avg idle: 0s

DALIA () — 1 snapshots, avg idle: 0s

FADY-ELECTRIC () — 1 snapshots, avg idle: 0s

MARIAN-PC () — 1 snapshots, avg idle: 0s

Endpoint Deep Visibility (Sysmon)

Per-process command lines, network connections, and DNS from Sysmon on endpoints. 116 total events across 9 endpoint(s).

Administrator

ProcessDestinationPortCount
D:\nodejs\node.exe0:0:0:0:0:0:0:130002
C:\Users\Administrator\.local\bin\claude.exe160.79.104.104431
System172.178.160.261371
C:\Windows\System32\dns.exe0:0:0:0:0:0:0:1645001
C:\Program Files (x86)\cloudflared\cloudflared.exe198.41.192.5778442
C:\Program Files\Git\usr\bin\ssh.exe192.168.2.30221
C:\Windows\System32\dns.exe192.168.128.24338591
C:\Windows\System32\dns.exe192.168.128.102605401
C:\Windows\System32\dns.exe192.168.2.226564691
C:\Program Files\Google\Chrome\Application\chrome.exe224.0.0.25153531
C:\Program Files\Google\Chrome\Application\chrome.exe192.168.128.10253531
C:\Windows\System32\dns.exe192.168.128.102610601
C:\Windows\System32\dns.exe192.168.2.226512581
C:\Windows\System32\dns.exe192.168.2.226544621
C:\Program Files\Netbird\netbird.exe192.168.2.3518202
ProcessCommand LineParentCount
C:\Program Files\Git\usr\bin\bash.exe"C:\Program Files\Git\usr\bin\bash.exe" /c/Users/Administrator/.claude/plugins/cache/claude-plugins-official/security...C:\Program Files\Git\usr\bin\bash.exe1
C:\Windows\System32\wsmprovhost.exeC:\Windows\system32\wsmprovhost.exe -EmbeddingC:\Windows\System32\svchost.exe1
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Command "(Get-ScheduledTask -TaskName 'MDM-Dail...C:\Program Files\Git\usr\bin\bash.exe1
C:\Program Files\Git\usr\bin\cat.exe"C:\Program Files\Git\usr\bin\cat.exe" //MDM-SERVER/SYSVOL/MDM.local/Policies/{A1E46CA8-2950-467D-BF36-D3A313A68B1C}/...C:\Program Files\Git\usr\bin\bash.exe1
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteracti...C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1
C:\Program Files\Git\usr\bin\ls.exe"C:\Program Files\Git\usr\bin\ls.exe" -la //MDM-SERVER/SYSVOL/MDM.local/Policies/{A1E46CA8-2950-467D-BF36-D3A313A68B1...C:\Program Files\Git\usr\bin\bash.exe1
C:\Program Files\Git\usr\bin\ssh.exe"C:\Program Files\Git\usr\bin\ssh.exe" -i C:\Users\Administrator\.ssh\id_ed25519 -o UserKnownHostsFile=C:\Users\Admin...C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1
C:\Windows\System32\fsutil.exe"C:\Windows\system32\fsutil.exe" hardlink list D:\Scripts\Reporting\tenant-monitor-report.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1
C:\Windows\System32\dllhost.exeC:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}C:\Windows\System32\svchost.exe1
C:\Program Files\Git\usr\bin\bash.exe"C:\Program Files\Git\bin\..\usr\bin\bash.exe" -c "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/posttooluse.py"C:\Program Files\Git\bin\bash.exe2
ProcessDomainCount
github.com2
C:\Program Files\Microsoft OneDrive\26.084.0504.0007\OneDrive.Sync.Service.exemobile.events.data.microsoft.com2
C:\Windows\System32\wbem\WmiPrvSE.exeDESIGNER-PC1
C:\Program Files\Microsoft OneDrive\OneDrive.exeself.events.data.microsoft.com2
D:\nodejs\node_modules\@openai\codex\node_modules\@openai\codex-win32-x64\vendor\x86_64-pc-windows-msvc\codex\codex.exechatgpt.com2
C:\Program Files\Google\Chrome\Application\chrome.exesafebrowsing.googleapis.com2
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeDESIGNER-OFFICE1
C:\Program Files\Google\Chrome\Application\chrome.execlientservices.googleapis.com2
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMDM-SERVER1
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeapi.telegram.org1

Network Traffic (Meraki)

ClientIPSent (MB)Received (MB)Total (MB)
CNC-PC-XP-600192.168.2.1260.100.1
e2af154d-7471-4303-8cad-503d12b52df7192.168.2.19700.50.6
cdbdad29-9543-4261-b5a9-97e7e7ec301c192.168.2.2261.13.64.8
Watch192.168.2.41000
830d0bf8-3164-418a-b46a-cbcd27d1c765192.168.2.16800.20.3
Marian-pc192.168.2.1660.52.42.9
bc:24:11:4a:c0:1c192.168.2.370.100.1
BB8836102192.168.2.73000
PC-19192.168.2.61011
bc:24:11:e3:39:cf192.168.2.357.80.17.9
5e:94:ff:71:46:4b192.168.2.174000
bc:24:11:48:6a:35192.168.2.4000.30.3
bc:24:11:6d:df:90192.168.2.4000.10.1
Nervine-PC192.168.2.720.63.64.3
Dalia-Salib-PC192.168.2.1530.615.316

Microsoft 365 Activity

Microsoft's 7-day aggregate ending ~2 days ago (does not align exactly with the Mon–Sun report window). Sign-ins are real-time for the full week.

Email Activity (Last 7 Days)

UserSentReceivedReadLast Active
Ehab Guirguis604571222026-05-30
David Mikhail42641062026-05-29
Mina Iscandar412011962026-05-30
Mahmoud Assi311021322026-05-29
Atef Awad211692222026-05-30
Hani Abdelmalek211292242026-05-29
David Guirguis201024282026-05-30
Nervine Wassef173112252026-05-29
Marian Alfons13141212026-05-29
Dalia Sidhom1339332026-05-30
Michael Guirguis91841682026-05-30
Ragy Awadallah822122026-05-29
Fady Gorgy723772026-05-29
Helena Awad233122026-05-28
Prabhkaran Singh1672026-05-29
David Saad0102026-03-30
Mina Iscandar02002025-03-17
Mary Guirguis013172026-05-28
Ehab Kodsi Guirguis09752026-05-29

Teams Activity (Last 7 Days)

UserChatsCallsMeetingsLast Active
Ehabk40002026-05-29
Atef Awad3022026-05-29
Minai3002026-05-29
Hani3002026-05-29
Ragy Awadallah2002026-05-29
Michael Guirguis1002026-05-27
Dalia Sidhom1002026-05-30

Sign-In Activity

UserAppLocationStatusLast Time
Info Desk | MDM WoodOffice 365 Exchange OnlineDelhi, INFailed (50126) (11x)May 30 7:50 AM
Mina IscandarOfficeHomeBroadway, GBFailed (50126)May 31 6:01 AM
Mary GuirguisMicrosoft OfficeMississauga, CAFailed (50126)May 28 5:04 PM
Info Desk | MDM WoodOffice 365 Exchange OnlinePerugia, ITFailed (50053) (14x)May 31 12:23 PM
Mina IscandarMicrosoft Azure CLICedar Knolls, USFailed (50053) (5x)May 30 2:24 PM
David GuirguisCloudflare AccessMississauga, CAFailed (501314)May 28 10:08 AM
Mina IscandarMicrosoft Device Registration ClientMilton, CAFailed (50074)May 30 5:53 PM
Mina IscandarMy SigninsMilton, CAFailed (50074)May 28 10:29 PM
Mina IscandarMy SigninsMilton, CAFailed (500121)May 28 10:28 PM
Mina IscandarOne Outlook WebToronto, CAFailed (50126) (2x)May 29 1:18 PM
Dalia SidhomSharePoint Online Web Client ExtensibilityMississauga, CASuccessMay 29 9:59 AM
Mina IscandarOne Outlook WebToronto, CASuccessMay 29 1:21 PM
David SaadOffice Online Core SSOMississauga, CASuccess (13x)May 29 2:19 PM
Michael GuirguisSharePoint Online Web Client ExtensibilityMississauga, CASuccess (2x)May 31 3:15 PM
Mina IscandarMicrosoft Account Controls V2Milton, CASuccess (20x)May 28 10:29 PM
David SaadOne Outlook WebMississauga, CASuccessMay 29 2:53 PM
Dalia SidhomApp Home Pages ProdMississauga, CASuccess (2x)May 29 10:20 AM
David GuirguisMicrosoft Account Controls V2Mississauga, CASuccess (3x)May 30 7:09 PM
Michael GuirguisOne Outlook WebMississauga, CASuccessMay 30 9:00 PM
Michael GuirguisMicrosoft Office 365 PortalMississauga, CASuccess (2x)May 31 2:55 PM
Atef AwadOffice365 Shell WCSS-ClientMississauga, CASuccess (5x)May 28 12:28 PM
Hani AbdelmalekOne Outlook WebToronto, CASuccess (5x)May 30 4:42 PM
Mahmoud AssiOne Outlook WebToronto, CASuccess (2x)May 29 3:29 PM
Mina IscandarMicrosoft OutlookMilton, CASuccessMay 30 5:43 PM
David GuirguisOffice365 Shell WCSS-ClientMississauga, CASuccess (5x)May 30 7:09 PM

File Access (Shared Drives)

No file access events recorded. Data will appear once users access audited shares.

Security Audit

Password Health
AccountPassword AgeStatus
MDM.111774d - STALENever expires
Hany Abdelmalek1769d - STALENever expires
MDM.261739d - STALENever expires
Nervine Wassef1739d - STALENever expires
Ehab Kodsi1735d - STALENever expires
Atef Awad1714d - STALENever expires
Administrator837d - STALENever expires
Michael Guirguis526d - STALENever expires
David Guirguis514d - STALENever expires
Mina Iscandar488d - STALENever expires
Karan460d - STALENever expires
Marian Alfons412d - STALENever expires
Dalia Sidhom346dNever expires
Fady331dNever expires
Meetings289dNever expires
David Mikhail216dNever expires
MDM.16171dNever expires
Shady Mikhail123dNever expires
Helena Awad114dNever expires
svc-openclaw74dNever expires
CodexSandboxOnline47dNever expires
CodexSandboxOffline47dNever expires
Inactive Accounts (90+ days)
AccountLast Login
David Guirguis109d ago
Mary Guirguis363d ago
Fady191d ago
MDM.16170d ago
Shady Mikhail110d ago
CodexSandboxOnlineNever
Wiki Test WorkerNever
Wiki Test Mgr TelecomNever
Wiki Test AdminNever
System Health
Last Windows UpdateKB5089760 - 2d ago
Domain FirewallDISABLED
SMBv1Disabled (good)
C: Free Space19.6 GB
D: Free Space4531.8 GB
MDM-SERVER Monitoring • Jun 01, 2026 7:11 AM • MDM Contracting