How to find out which domain account installed software on shared machine

[j]

Thanks for the reply,
Here's the issue:
When I reformatted the box last monday, I did a clean
install of XP. Today, one week later, the end-users are
complaining of pop-ups, slow/erratic performance etc.
Basically, within that last week, there were various
applications (i.e. AOL service, various web toolbars,
spyware, adware etc). I have a computer use policy that
explicity forbids the installation of 'third-party'
software, and now I must enforce this policy. I checked
event logs, and it gave me who was using AOL on the
machine, but that's all, under Event Viewer -> System.
Under Event Viewer -> Application, when the source is
MsiInstaller, user value is N/A. So:

3 users/ 1 Windows XP machine
Windows 2003 domain
I have a list of what unauthorized software is present on
the machine - is there a way to backtrack, and find out
which user installed it?

 

[Steven L Umbach]

Your best bet would be to look at the folder/executeable file and check who
is the owner in security page/advanced - owner. A better solution may be to
use Group Policy [gpedit.msc on local computer] to enforce Internet Explorer
web content zone settings and use Software Restriction Policies to manage
what users can install on a computer [ XP Pro]. SRP are very powerful once
you figure them out though the end users will hate you if you care. The link
below may be helpful. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;310791