Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I do some admin work for a volunteer emergency services organization, and they've decided to migrate their "public" (available for the use of all 35+ members) workstations to Linux.

Is there any Windows tool that I can use to track which programs are used by which users, and how often? As the end result, I'm looking to come up with a list of software that's used, and how often it's used, to determine what sort of backwards compatibility (Wine, dual-boot, etc.) I'll have to implement.

share|improve this question

closed as off-topic by masegaloeh, 84104, Katherine Villyard, Scott Pack, Greg Askew Apr 18 '15 at 16:18

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Requests for product, service, or learning material recommendations are off-topic because they attract low quality, opinionated and spam answers, and the answers become obsolete quickly. Instead, describe the business problem you are working on, the research you have done, and the steps taken so far to solve it." – masegaloeh, 84104, Katherine Villyard, Scott Pack, Greg Askew
If this question can be reworded to fit the rules in the help center, please edit the question.

So I'm guessing there's nothing free (preferably Free) and easy? – Jason Antman Aug 7 '09 at 22:47

Check out Rescuetime, it does all of that and more.

share|improve this answer

You could do this using NTFS auditing, assuming that the PCs use NTFS. This is available under Security | Advanced | Auditing, and you'll want auditing on the Traverse Folder/Execute File action for the Everyone security principal.

A dedicated app to monitor it would be preferable though.

share|improve this answer

There's no built-in tool in Windows to do what you're looking for, per se.

You could crib something together by turning on the "Process Tracking" success auditing and then mining the event log data. You're going to get a LOT of data to wade through, but what you're looking for would be in there.

If you have experience parsing logs you could probably work out a solution to export and parse the event logs from the various computers to get what you're looking for. If you don't have such experience you're going to find this a challenging and daunting task.

The "C:\WINDOWS\PreFetch" directory will show you a lot of names of programs users are running, but it's not as exacting as the event log / auditing method. I don't recall the mechanism by which it gets cleaned out, but records don't linger in there permanently. (some more information about the "Prefetch" behavior is available here:

share|improve this answer

Two things I forgot to add that greatly complicate this:

1) This is a zero-budget project, so buying software is out of the question. 2) The three machines are running Windows XP home.

Perhaps the only solution here is to write some sort of daemon ("service" for windows?) that grabs a process list and dumps it to a database?

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.