Question Locked

Record events on Windows

0 helpful
2 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi all,
Is there any aplication or freeware tool you guys know that could display all the changes on the pc (files created or modified) Aplpication installed or removed and registries entries in a specific date?

Regards,
rui

2 replies

by richmcse

I am not sure about freeware or app that does precisely all you want. I am not sure if you are talking about doing this to a whole network, or a home pc that a few people use. However you can audit quit a few of these things by enabling audit files in the group policy security setting. You can then monitor this in the event viewer. Be careful with this, the log can fill up fast.

As for the registry, you can audit it as well. The steps to do that are as follows:
1. Start the registry editor (regedt32.exe)
2. Select the key you wish to audit (e.g. HKEY_LOCAL_MACHINE\Software)
3. From the Security menu select Auditing
4. Check the "Audit Permission on Existing Subkeys" if you want subkeys to also be audited
5. Click the Add button and select the users you want to be audited, click Add and then click OK
6. Once there are names in the "Names" box you can select which events to be audited, whether success or failure.
7. Fill in all the information click OK
You will need to make sure that Auditing for File and Object access is enabled (use User Manager - Polices - Audit).

If this is a network you are talking about, normal users shouldn't have access to the registry.

Hope this helps.

This discussion is closed to new replies.