up vote 1 down vote favorite
share [g+] share [fb]

Am I correct, that if a program is installed on a Server and shows up in the 'Add Remove/Program programs', then it must have been installed when a user has logged onto the server either at the physical console, or using RDP and not when a user has accessed the server via a share?

And if so, then this should show up as Event ID's 528.

In other words, if I just look at Event ID 528, I can get a list of suspects. Is this correct?

link|improve this question
50% accept rate
Programs can be installed without a user's interactive logon -- i.e Scheduled Task, batch file, remote agent -- Using credentials such as BUILTIN\SYSTEM. – jscott Aug 25 '10 at 15:20
feedback

3 Answers

up vote 1 down vote

In general, yes. You probably want to look at the logon type as well to determine how the user accessed the server. I'm thinking that you want to look for logon types 2, 10, and possibly 5.

link|improve this answer
You said 'In general, yes'. What are the non-general conditions? – sgmoore Aug 25 '10 at 16:05
I just meant that in general you can find logon information in the security log if you have logon auditing enabled but that this might not help you solve your mystery. – joeqwerty Aug 25 '10 at 17:07
feedback
up vote 1 down vote

With Windows Server you can have multiple simultaneous users logged on. You can use the Event Log to see which users were on at the time. But this will not immediately tell you which one performed the install.

A better option might be to check the directory of the software install -- e.g. C:\program files\vendor\title. The install directory may be owned by the user that performed the install. Also/instead, the installation directory's ACL may contain an entry granting the user Full control.

EDIT

If the install was from an MSI you can filter your Application Event Log for the Source "MsiInstaller" to see related events.

link|improve this answer
In this particular case, the program must not have been an Msi file as MsiInstaller does not show anything. Also there is only one user who is recorded via Event ID 528 (who also happens to be the owner of the directory). However I wanted to be sure that Event ID 28 was a complete list, and not just a partial list. – sgmoore Aug 25 '10 at 16:04
@sgmoore: Event ID 528 is a successful logon event. Check the types to see which it is, as joeqwerty suggests. Types 2 and 10 are interactive logons, type 5 is as a service. – jscott Aug 26 '10 at 16:55
feedback
up vote 0 down vote

That will cover the most typical use cases, however apps can be installed by remote processes (such as PSExec, batch scripting, or a remote deployment tool such as CA Unicenter.) They will not necessarily log that event code.

What you describe is a fine place to start, however.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.