windows event logs for launching applications or opening files.

pma111
pma111 used Ask the Experts™
on
do any of the default event logs on windows 7 give any clues when certain applications are started/closed, e.g web browsers, or office software such as outlook, word, excel.

And do any of the default event logs also capture times specific files were opened, e.g. a file on a desktop 123.docx (I am guessing this is an option but rarely enabled).
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Commented:
Default settings will not show these events. In the computer configuration (Local Group Policy, only available in Pro or higher), you can set the Auditing to enable Object Access and Process Tracking.
After that, select folders or files to enable Auditing as well (don't select too many folders though, your log will be overrun)

Author

Commented:
>and Process Tracking

is this what would capture loading apps like Microsoft Word.

Author

Commented:
Thank you. Out of interest can you suggest any articles on what events are logged in windows 7 enterprise by default? I appreciate organisations can tailor settings to their own requirements and policies but knowing what is logged by default would be very interesting to me.

Commented:
By default, the security logs show some logon/logoff events. Nothing too exciting. Auditing requires more from your system, and has been off by default since forever (my memory doesn't go beyond Win2000 though)

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial