Windows Forum
by darts32
Winvestigator works well.
Here's a link to some others also.
by tareed
by joseph moore
Ok, I just tried this on my Win2KPro workstation, and it works. I was a little shocked, actually, but I guess it does make sense!
Open Local Security Policy on the Win2kPro machine, and go to Local Policies -> Audit Policy.
The policy Audit Object Access is what you 1st need to enable. Double click this policy and choose Success to enable auditing of successful file access (when someone click on the Solitaire link, for example).
Ok, now open up Windows Explorer and go to the Winnt\System32 folder. This is where the games like Solitaire and Mindsweeper are stored.
Right-click on each file (for Solitaire, the file is SOL.EXE), and choose Properties.
Click the Security tab, and then click the Advanced button.
Click the Auditing tab.
Click Add.
A box comes up with the name of your domain, and the domain group and user accounts. Select the Everyone group so that ANYONE using that system and running Solitaire will cause auditing to start.
You will get a new windowcalled "Auditing Entry for SOL.EXE" with a list of specific things you can audit.
Click the box in the Success column for "Traverse Folder/Execute File" then click OK on all open windows to save the changes.
by joseph moore
Ok, now open up Solitaire.
Next, open up Event Viewer, and go to the Security log. You should have 4 records in there. This right records 4 records in the logs, 2 Event ID 560 and 2 Event ID 562.
Event ID 560 is the file executed message. It looks like this:
Event Type: Success Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 12/19/2002
Time: 9:27:11 PM
User: MYDOMAIN\JOE
Computer: MY_WORKSTATION
Description:
Object Open:
Object Server: Security
Object Type: File
Object Name: C:\WINNT\system32\sol.exe
New Handle ID: 2876
Operation ID: {0,137898604}
Process ID: 556
Primary User Name: JOE
Primary Domain: MYDOMAIN
Primary Logon ID: (0x0,0x20BF7D)
Client User Name: -
Client Domain: -
Client Logon ID: -
Accesses SYNCHRONIZE
Execute/Traverse
Privileges -
by joseph moore
So, now you know that JOE ran SOL.EXE at 9:27PM.
hope this helps
by tareed
by tareed
This discussion is closed to new replies.
Sort by Trending