In reply to mark k..

then all you can do is cross your fingers and hope

Well, you can audit all your privileged users, and your code (and everything else, depending on your risk assessment). I notice you've slightly walked that back, by saying that you can audit.

We have tools that checks code against pristine copies. I was hoping Vladimir, as a service to his users, might have a fragment for auditing the users - if not, it's a few hours work (or Google first to see who else has done it!).

Apologies to Jeff - I mistakenly clicked "Report" instead of "Reply" before typing this. I don't seem to be able to "Unreport".