Audit User Installations

[donald]

I would like information on tools I can use, both native
and 3rd party, to audit user installations on pc's. We
have to use the compatible workstation template, which
unfortunately allows too much access to domain users, so I
need a way to see if unauthorized users are installing
applications. I would need to be able to do this at the
local pc. Thanks for your help.

 

[CETroutman]

You could either:

1) modify the policy to disallow access to software installation, or

2) go the extreme route of setting up the workstations with software that
returns the PC to a predefined state at each and every reboot.
Unfortunately, I don't remember the name of any particular ones (I seem to
remember one good one starts with "G"...)

HTH,

CET

 

[donald]

Unfortuantely I do not have that much control over this
network. I was hoping I could use the audit functions in
Windows to see who the problem user is but I do not have
access to edit the Local Security Policy, as we are a
domain environment; I cannot create GPO's either.

Thanks for your input.

 

[Steven L Umbach]

Most installations would probably be to the program files folder, You could try
auditing create folders to just the program files folder. You would have to enable
auditing of object access also which will generate a lot of seemingly unrelated
events however and the size of the security log in Event Viewer will need to be
substantially increased. You might want to communicate with the powers to be about
the possibility to enable applications to run without comatws.inf template by custom
modification of files/ntfs permissions possibly with the help of the software
vendors. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;301640
http://support.microsoft.com/default.aspx?scid=kb;en-us;300549