domain policy audit question

[roseta]

Hello,



I want to track the applications that users open on their client. What
security option must be set to audit in domain policy so we can track
the applications that clients open and see their records in event
viewer?



Thanks in advance

roseta

 

[Herb Martin]

I want to track the applications that users open on their client. What
security option must be set to audit in domain policy so we can track
the applications that clients open and see their records in event
viewer?

"Audit process tracking" in the GPO Computer->Windows settings->
Security->Local policies->Audit Policy (near the bottom of the list.)

This will however collect those logs on each machine so you will
need a (convenient) way to collect and manage these logs.

Also note, there is a pretty good chance you will need to adjust
the log size and log full behavior (which can be done on each machine
from a central GPO too.)