application or system event logs showing lauch of apps

pma111 used Ask the Experts™
Do any of the application or system event logs on XP show what applications a user ran? I.e. if for a given day a user opened MS-word 5 times, would they be in any of the default evt files, or anywhere else?
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
No .. there is  nothing like that .
You can do this by enabling " Audit Process Tracking"  on local policies under windows XP , by enabling this audit ; you will get an event in your security event log file about the process that was created , it also shows you the executable name and the  user that has created the process.

However , I enabled in my test machine and it started generating many events ; so it doesn't look to be an ideal solution for a permanent use ; but you can enable for temporary audits.
Control Panel > Administrative Tools > Local security Policy > Local Policy > Audit Policy > Audit Process Tracking.


Cheers so by default unless that isn't on no luck. The prefetch folder looks interesting mind....
you can set audit based on SUCCESS or FAILURE ; for example if a user opens note pad application successfully , you will see a security event log about it that tells you a particular user name has started a process : c:\windows\system32\notepad.exe

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial