Identifying software installers

[Paul Nagl]

Hi:

We have a bit of a problem with some of the users at the hospital I work at. There are some of them who have a habit of installing unauthorized software on their computer which at times can really screw these computers up. I would really like to identify them. Are there any logs that record when software is installed, what it is, and who was logged on when it was done? (We give all users administrative access to windows to get authorized software installed.)

Thanks
Paul



___________________________________
Paul Nagl, CNA, MCP
Network Specialist
Central Michigan Community Hospital
989-772-6846
www.cmch.org

 

[Guest]

Thanks I tried that, but even after rebooting it didn't
appear to help any. Evidently the only shortcuts that work
without giving the error is IE and Outlook, everything
else errors out. The only way I can access some apps is
from the command prompt; even in the search screen I can
see the files, but can't double-click on any folders or
files to open\run them I even replaced the rundll32.exe
file as suggested by another tech. Problems still exist.
Any more suggestions---I'm checking out the articles you
referenced. I've run the W2K repair option twice already.

Dennis

-----Original Message-----
Hi:

We have a bit of a problem with some of the users at the

hospital I work at. There are some of them who have a
habit of installing unauthorized software on their
computer which at times can really screw these computers
up. I would really like to identify them. Are there any
logs that record when software is installed, what it is,
and who was logged on when it was done? (We give all
users administrative access to windows to get authorized
software installed.)

 

[Paul Nagl]

I think you replied to the wrong thread.

P




___________________________________
Paul Nagl, CNA, MCP
Network Specialist
Central Michigan Community Hospital
989-772-6846
www.cmch.org
Thanks I tried that, but even after rebooting it didn't
appear to help any. Evidently the only shortcuts that work
without giving the error is IE and Outlook, everything
else errors out. The only way I can access some apps is
from the command prompt; even in the search screen I can
see the files, but can't double-click on any folders or
files to open\run them I even replaced the rundll32.exe
file as suggested by another tech. Problems still exist.
Any more suggestions---I'm checking out the articles you
referenced. I've run the W2K repair option twice already.

Dennis

-----Original Message-----
Hi:

We have a bit of a problem with some of the users at the

hospital I work at. There are some of them who have a
habit of installing unauthorized software on their
computer which at times can really screw these computers
up. I would really like to identify them. Are there any
logs that record when software is installed, what it is,
and who was logged on when it was done? (We give all
users administrative access to windows to get authorized
software installed.)

 

[George Hester]

Installed software should appear in the event viewer. Those that use the Windows Installer technology anyway. The other thing you can do is look in the shortcut folders that are made for installed applications. They will show the date and time they were created. That should let you know who was on the machine at the time the software was installed. But of course this will only tell you the user that signed on. If all your users use Administrator to sign on then well you're stuck to identify the particular person. But I can tell you you need a better administrator. Windows should not be set up this way.

--
George Hester
__________________________________
I think you replied to the wrong thread.

P




___________________________________
Paul Nagl, CNA, MCP
Network Specialist
Central Michigan Community Hospital
989-772-6846
www.cmch.org
Thanks I tried that, but even after rebooting it didn't
appear to help any. Evidently the only shortcuts that work
without giving the error is IE and Outlook, everything
else errors out. The only way I can access some apps is
from the command prompt; even in the search screen I can
see the files, but can't double-click on any folders or
files to open\run them I even replaced the rundll32.exe
file as suggested by another tech. Problems still exist.
Any more suggestions---I'm checking out the articles you
referenced. I've run the W2K repair option twice already.

Dennis

-----Original Message-----
Hi:

We have a bit of a problem with some of the users at the

hospital I work at. There are some of them who have a
habit of installing unauthorized software on their
computer which at times can really screw these computers
up. I would really like to identify them. Are there any
logs that record when software is installed, what it is,
and who was logged on when it was done? (We give all
users administrative access to windows to get authorized
software installed.)

Thanks
Paul



___________________________________
Paul Nagl, CNA, MCP
Network Specialist
Central Michigan Community Hospital
989-772-6846
www.cmch.org

--------------------------------------------------------------------------------


I think you replied to the wrong thread.

P




___________________________________
Paul Nagl, CNA, MCP
Network Specialist
Central Michigan Community Hospital
989-772-6846
www.cmch.org
Thanks I tried that, but even after rebooting it didn't
appear to help any. Evidently the only shortcuts that work
without giving the error is IE and Outlook, everything
else errors out. The only way I can access some apps is
from the command prompt; even in the search screen I can
see the files, but can't double-click on any folders or
files to open\run them I even replaced the rundll32.exe
file as suggested by another tech. Problems still exist.
Any more suggestions---I'm checking out the articles you
referenced. I've run the W2K repair option twice already.

Dennis

-----Original Message-----
Hi:

We have a bit of a problem with some of the users at the

hospital I work at. There are some of them who have a
habit of installing unauthorized software on their
computer which at times can really screw these computers
up. I would really like to identify them. Are there any
logs that record when software is installed, what it is,
and who was logged on when it was done? (We give all
users administrative access to windows to get authorized
software installed.)

 

[Paul Nagl]

Well, actually everyone doesn't log in as administrator just as a user who is in the administrators group.
I see where event viewer shows me some installation records. Is there any way to identify which user was on the system for a given event or at a given time?

Paul



___________________________________
Paul Nagl, CNA, MCP
Network Specialist
Central Michigan Community Hospital
989-772-6846
www.cmch.org
Installed software should appear in the event viewer. Those that use the Windows Installer technology anyway. The other thing you can do is look in the shortcut folders that are made for installed applications. They will show the date and time they were created. That should let you know who was on the machine at the time the software was installed. But of course this will only tell you the user that signed on. If all your users use Administrator to sign on then well you're stuck to identify the particular person. But I can tell you you need a better administrator. Windows should not be set up this way.

--
George Hester
__________________________________
I think you replied to the wrong thread.

P




___________________________________
Paul Nagl, CNA, MCP
Network Specialist
Central Michigan Community Hospital
989-772-6846
www.cmch.org
Thanks I tried that, but even after rebooting it didn't
appear to help any. Evidently the only shortcuts that work
without giving the error is IE and Outlook, everything
else errors out. The only way I can access some apps is
from the command prompt; even in the search screen I can
see the files, but can't double-click on any folders or
files to open\run them I even replaced the rundll32.exe
file as suggested by another tech. Problems still exist.
Any more suggestions---I'm checking out the articles you
referenced. I've run the W2K repair option twice already.

Dennis

-----Original Message-----
Hi:

We have a bit of a problem with some of the users at the

hospital I work at. There are some of them who have a
habit of installing unauthorized software on their
computer which at times can really screw these computers
up. I would really like to identify them. Are there any
logs that record when software is installed, what it is,
and who was logged on when it was done? (We give all
users administrative access to windows to get authorized
software installed.)

Thanks
Paul



___________________________________
Paul Nagl, CNA, MCP
Network Specialist
Central Michigan Community Hospital
989-772-6846
www.cmch.org

--------------------------------------------------------------------------------


I think you replied to the wrong thread.

P




___________________________________
Paul Nagl, CNA, MCP
Network Specialist
Central Michigan Community Hospital
989-772-6846
www.cmch.org
Thanks I tried that, but even after rebooting it didn't
appear to help any. Evidently the only shortcuts that work
without giving the error is IE and Outlook, everything
else errors out. The only way I can access some apps is
from the command prompt; even in the search screen I can
see the files, but can't double-click on any folders or
files to open\run them I even replaced the rundll32.exe
file as suggested by another tech. Problems still exist.
Any more suggestions---I'm checking out the articles you
referenced. I've run the W2K repair option twice already.

Dennis

-----Original Message-----
Hi:

We have a bit of a problem with some of the users at the

hospital I work at. There are some of them who have a
habit of installing unauthorized software on their
computer which at times can really screw these computers
up. I would really like to identify them. Are there any
logs that record when software is installed, what it is,
and who was logged on when it was done? (We give all
users administrative access to windows to get authorized
software installed.)

 

[George Hester]

I would think. Just enable Auditing for succes\failure of logon and logoff activity using Local Security.

--
George Hester
__________________________________
Well, actually everyone doesn't log in as administrator just as a user who is in the administrators group.
I see where event viewer shows me some installation records. Is there any way to identify which user was on the system for a given event or at a given time?

Paul



___________________________________
Paul Nagl, CNA, MCP
Network Specialist
Central Michigan Community Hospital
989-772-6846
www.cmch.org
Installed software should appear in the event viewer. Those that use the Windows Installer technology anyway. The other thing you can do is look in the shortcut folders that are made for installed applications. They will show the date and time they were created. That should let you know who was on the machine at the time the software was installed. But of course this will only tell you the user that signed on. If all your users use Administrator to sign on then well you're stuck to identify the particular person. But I can tell you you need a better administrator. Windows should not be set up this way.

--
George Hester
__________________________________
I think you replied to the wrong thread.

P




___________________________________
Paul Nagl, CNA, MCP
Network Specialist
Central Michigan Community Hospital
989-772-6846
www.cmch.org
Thanks I tried that, but even after rebooting it didn't
appear to help any. Evidently the only shortcuts that work
without giving the error is IE and Outlook, everything
else errors out. The only way I can access some apps is
from the command prompt; even in the search screen I can
see the files, but can't double-click on any folders or
files to open\run them I even replaced the rundll32.exe
file as suggested by another tech. Problems still exist.
Any more suggestions---I'm checking out the articles you
referenced. I've run the W2K repair option twice already.

Dennis

-----Original Message-----
Hi:

We have a bit of a problem with some of the users at the

hospital I work at. There are some of them who have a
habit of installing unauthorized software on their
computer which at times can really screw these computers
up. I would really like to identify them. Are there any
logs that record when software is installed, what it is,
and who was logged on when it was done? (We give all
users administrative access to windows to get authorized
software installed.)

Thanks
Paul



___________________________________
Paul Nagl, CNA, MCP
Network Specialist
Central Michigan Community Hospital
989-772-6846
www.cmch.org

--------------------------------------------------------------------------------


I think you replied to the wrong thread.

P




___________________________________
Paul Nagl, CNA, MCP
Network Specialist
Central Michigan Community Hospital
989-772-6846
www.cmch.org
Thanks I tried that, but even after rebooting it didn't
appear to help any. Evidently the only shortcuts that work
without giving the error is IE and Outlook, everything
else errors out. The only way I can access some apps is
from the command prompt; even in the search screen I can
see the files, but can't double-click on any folders or
files to open\run them I even replaced the rundll32.exe
file as suggested by another tech. Problems still exist.
Any more suggestions---I'm checking out the articles you
referenced. I've run the W2K repair option twice already.

Dennis

-----Original Message-----
Hi:

We have a bit of a problem with some of the users at the

hospital I work at. There are some of them who have a
habit of installing unauthorized software on their
computer which at times can really screw these computers
up. I would really like to identify them. Are there any
logs that record when software is installed, what it is,
and who was logged on when it was done? (We give all
users administrative access to windows to get authorized
software installed.)

Thanks
Paul



___________________________________
Paul Nagl, CNA, MCP
Network Specialist
Central Michigan Community Hospital
989-772-6846
www.cmch.org

--------------------------------------------------------------------------------


Well, actually everyone doesn't log in as administrator just as a user who is in the administrators group.
I see where event viewer shows me some installation records. Is there any way to identify which user was on the system for a given event or at a given time?

Paul



___________________________________
Paul Nagl, CNA, MCP
Network Specialist
Central Michigan Community Hospital
989-772-6846
www.cmch.org
Installed software should appear in the event viewer. Those that use the Windows Installer technology anyway. The other thing you can do is look in the shortcut folders that are made for installed applications. They will show the date and time they were created. That should let you know who was on the machine at the time the software was installed. But of course this will only tell you the user that signed on. If all your users use Administrator to sign on then well you're stuck to identify the particular person. But I can tell you you need a better administrator. Windows should not be set up this way.

--
George Hester
__________________________________
I think you replied to the wrong thread.

P




___________________________________
Paul Nagl, CNA, MCP
Network Specialist
Central Michigan Community Hospital
989-772-6846
www.cmch.org
Thanks I tried that, but even after rebooting it didn't
appear to help any. Evidently the only shortcuts that work
without giving the error is IE and Outlook, everything
else errors out. The only way I can access some apps is
from the command prompt; even in the search screen I can
see the files, but can't double-click on any folders or
files to open\run them I even replaced the rundll32.exe
file as suggested by another tech. Problems still exist.
Any more suggestions---I'm checking out the articles you
referenced. I've run the W2K repair option twice already.

Dennis

-----Original Message-----
Hi:

We have a bit of a problem with some of the users at the

hospital I work at. There are some of them who have a
habit of installing unauthorized software on their
computer which at times can really screw these computers
up. I would really like to identify them. Are there any
logs that record when software is installed, what it is,
and who was logged on when it was done? (We give all
users administrative access to windows to get authorized
software installed.)

Thanks
Paul



___________________________________
Paul Nagl, CNA, MCP
Network Specialist
Central Michigan Community Hospital
989-772-6846
www.cmch.org

--------------------------------------------------------------------------------


I think you replied to the wrong thread.

P




___________________________________
Paul Nagl, CNA, MCP
Network Specialist
Central Michigan Community Hospital
989-772-6846
www.cmch.org
Thanks I tried that, but even after rebooting it didn't
appear to help any. Evidently the only shortcuts that work
without giving the error is IE and Outlook, everything
else errors out. The only way I can access some apps is
from the command prompt; even in the search screen I can
see the files, but can't double-click on any folders or
files to open\run them I even replaced the rundll32.exe
file as suggested by another tech. Problems still exist.
Any more suggestions---I'm checking out the articles you
referenced. I've run the W2K repair option twice already.

Dennis

-----Original Message-----
Hi:

We have a bit of a problem with some of the users at the

hospital I work at. There are some of them who have a
habit of installing unauthorized software on their
computer which at times can really screw these computers
up. I would really like to identify them. Are there any
logs that record when software is installed, what it is,
and who was logged on when it was done? (We give all
users administrative access to windows to get authorized
software installed.)