which user installed which software?

[j]

When administering a network: How can one find out which
User installed a program on a Windows XP box? What I need
is a list of software each user installed, and when it was
installed.

 

[Carey Frisch [MVP]]

HOW TO: Audit User Access of Files, Folders, and Printers in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;310399&Product=winxp

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;308427&Product=winxp

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

-----------------------------------------------------------------------------


| When administering a network: How can one find out which
| User installed a program on a Windows XP box? What I need
| is a list of software each user installed, and when it was
| installed.

 

[j]

Thanks for the reply,
Here's the issue:
When I reformatted the box last monday, I did a clean
install of XP. Today, one week later, the end-users are
complaining of pop-ups, slow/erratic performance etc.
Basically, within that last week, there were various
applications (i.e. AOL service, various web toolbars,
spyware, adware etc). I have a computer use policy that
explicity forbids the installation of 'third-party'
software, and now I must enforce this policy. I checked
event logs, and it gave me who was using AOL on the
machine, but that's all, under Event Viewer -> System.
Under Event Viewer -> Application, when the source is
MsiInstaller, user value is N/A. So:

3 users/ 1 Windows XP machine
Windows 2003 domain
I have a list of what unauthorized software is present on
the machine - is there a way to backtrack, and find out
which user installed it?

 

[Roger Abell]

Look at the files that are the install, checking the dates
of their folders and the owner of the files.