Windows - track program usage by time and user

Question

I'll admit that I'm a total novice at Windows admin tasks... I haven't even used it on the desktop (except when I occasionally can't find something else) in years. I do some admin work for a volunteer emergency services organization, and they've decided to migrate their "public" (available for the use of all 35+ members) workstations to Linux.

Is there any Windows tool that I (having little Windows knowledge) can use to track which programs are used by which users, and how often? As the end result, I'm looking to come up with a list of software that's used, and how often it's used, to determine what sort of backwards compatibility (Wine, dual-boot, etc.) I'll have to implement.

Thanks, Jason

Answer 1

Check out Rescuetime, it does all of that and more.

Answer 2

You could do this using NTFS auditing, assuming that the PCs use NTFS. This is available under Security | Advanced | Auditing, and you'll want auditing on the Traverse Folder/Execute File action for the Everyone security principal.

A dedicated app to monitor it would be preferable though.

Answer 3

There's no built-in tool in Windows to do what you're looking for, per se.

You could crib something together by turning on the "Process Tracking" success auditing and then mining the event log data. You're going to get a LOT of data to wade through, but what you're looking for would be in there.

If you have experience parsing logs you could probably work out a solution to export and parse the event logs from the various computers to get what you're looking for. If you don't have such experience you're going to find this a challenging and daunting task.

The "C:\WINDOWS\PreFetch" directory will show you a lot of names of programs users are running, but it's not as exacting as the event log / auditing method. I don't recall the mechanism by which it gets cleaned out, but records don't linger in there permanently. (some more information about the "Prefetch" behavior is available here: http://windowshelp.microsoft.com/Windows/en-US/help/0ec5b471-ed65-43c4-a59b-c1fd975c42621033.mspx)

Answer 4

Two things I forgot to add that greatly complicate this:

1) This is a zero-budget project, so buying software is out of the question. 2) The three machines are running Windows XP home.

Perhaps the only solution here is to write some sort of daemon ("service" for windows?) that grabs a process list and dumps it to a database?