Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Am I correct, that if a program is installed on a Server and shows up in the 'Add Remove/Program programs', then it must have been installed when a user has logged onto the server either at the physical console, or using RDP and not when a user has accessed the server via a share?

And if so, then this should show up as Event ID's 528.

In other words, if I just look at Event ID 528, I can get a list of suspects. Is this correct?

share|improve this question
    
Programs can be installed without a user's interactive logon -- i.e Scheduled Task, batch file, remote agent -- Using credentials such as BUILTIN\SYSTEM. –  jscott Aug 25 '10 at 15:20
add comment

2 Answers 2

up vote 1 down vote accepted

In general, yes. You probably want to look at the logon type as well to determine how the user accessed the server. I'm thinking that you want to look for logon types 2, 10, and possibly 5.

share|improve this answer
    
You said 'In general, yes'. What are the non-general conditions? –  sgmoore Aug 25 '10 at 16:05
    
I just meant that in general you can find logon information in the security log if you have logon auditing enabled but that this might not help you solve your mystery. –  joeqwerty Aug 25 '10 at 17:07
add comment

That will cover the most typical use cases, however apps can be installed by remote processes (such as PSExec, batch scripting, or a remote deployment tool such as CA Unicenter.) They will not necessarily log that event code.

What you describe is a fine place to start, however.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.