Honestly we do that when we ask and no one speaks up. Lovingly called the “scream test” as we wait to see who screams.
I guess it depends on where you work. This was a large datacenter for a very large health insurance company. They made it a point later that day to remind people that it was a fireable offense to mess with production machines like that on purpose. And evidently the service he disabled was critical enough that it didn’t take long for the hammer to come down. There were plenty of ways to find out who owned the machine, he just chose the easiest and got fired on the spot for it.
Sounds like it was a last resort if he “couldn’t figure out” whose machine it was.
I don’t understand how that is even possible.
Are there no logs? No documentation? Does everyone share an admin user with full rights?
I mean, there has to be a way to find out who accessed the machine last time.