monitor logged users; ban mirc use

[Cristian Iosifescu]

Hi all !
Please tell me how can I, as an Administrator, to monitor the users that
logged to a computer, and perhaps, what programs they used ?

Plese tell me how can I ban the use of certain programs (i.e. mirc) by
deleting it at starup or shutdown, or just simply deny access.

Crios

 

[Lawrence Tse]

Hi,

You can enable audit logging to trace the logon event. The trace result
will be displayed on the event viewer. For more detail, you can search for
Windows help for the keyword "Audit logon events", it will give full
explanation. Below is the corresponding group policy location:
"Computer Configuration\Windows settings\Security Settings\Local
Policies\Audit Policy\"

For the program users have been using, as far as I know, Windows does not
have built-in tool to collect those information. Instead, you can employ
addon software or 3rd party tool to accomplish this task. Microsoft has
System Management Server, with the "Software Metering" feature that may suit
your need.

In order to ban certain application from execution, you can define software
restriction policy if you're running Windows 2003 domain, or Windows XP
(local policy in this case). Please check the following KB article for how
to implement: http://support.microsoft.com/default.aspx?scid=kb;en-us;324036

If you're using Windows 2000, you can configure the following local/group
policy:

"User Configuration\Administrative Templates\System\Don't run specific
Windows applications"

Lawrence Tse