asked on

Office 2016 applications activity reporting

Hi Experts,

Is anyone aware of any method aside from 3rd party tools, SCCM, etc., to monitor Office 2016/365 applications on a workstations?

Example, I have a Windows 10 workstation, I'm looking to see if any of the office apps, word, excel, outlook have been launched in the past 30 days.

I'm running Click to run and shared activation mode for licensing.

Thanks!

Daniel Pineault

What about PowerShell

gwmi win32_softwareFeature | select-object productname,lastuse -unique | Format-table -autosize

Open in new window

Get-CimInstance -Class win32_softwareFeature | Select-Object productname,lastuse -unique | Format-Table -Autosize

Open in new window

Ron Shorts

ASKER

This doesn't give any of the individual office applications.

Daniel Pineault

It does for me?!

...
Microsoft Excel MUI (English) 2013 20190901******.000000+***
Microsoft PowerPoint MUI (English) 2013 20190808******.000000+***
Microsoft Outlook MUI (English) 2013 20190905******.000000+***
...

Ron Shorts

ASKER

Only thing coming up under Office is this:

Office 16 Click-to-Run Extensibility Component
Office 16 Click-to-Run Localization Component
Office 16 Click-to-Run Extensibility Component 64-bit Registration
Office 16 Click-to-Run Licensing Component

Nothing for excel, word or anything, maybe because this is a click to run installation?

ASKER CERTIFIED SOLUTION

Daniel Pineault

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Daniel Pineault

Probably not the direction you want, but have you seen https://www.andreafortuna.org/2018/05/23/forensic-artifacts-evidences-of-program-execution-on-windows-systems/ it explains a few places in the registry where such information is stored, that you could create your own tool to extract the info, if you are so inclined (and have time).

Ron Shorts

ASKER

Thanks Daniel for the info and your help!