How to see what last batch was run on windows

Question

Is there a way to see what was the last batch (something.bat) run on windows? I was in a folder which contains lots of batches, as I was opening them one by one by right clicking and selecting notepad++. I have a feeling that I could have clicked 'run as administrator' instead of clicking 'open with notepad++'. I am not sure though, therefore I was thinking if there is a way to see what bat file was last run on windows (and when). it is windows 2008 server. thanks for your help.

Answer 1

Windows doesn't have a simple log for started processes. One thing that comes close is the Registry key UserAssist:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

It has entries for certain executed processes, the most interesting subkey is:

{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count

However those entries are ROT13 encoded. You could copy the value name and decode it manually. Instead you can use a tool that de-mystifies those entries, Didier Stevens' UserAssist

If you have a need for knowing about executed processes, you have at least two options to enable some logging. Of course this work only for future process starts:

• Enable Windows Auditing

• Use SysMon from SysInternals

The second one is easier to setup and most likely used less resources. However it only logs the start of a new process. This works fine if you double-click or open a batch file in Explorer but wont log a batch execution if started from within cmd.exe

Answer 2

Try Event Logs. Click Start and type "event logs". Under "Windows Logs" on the left, click "Application".

The batch file would need to have specific code that dumps an exception or completed message in the logs. If not, you may be out of luck.

Answer 3

One of the following should give you that (can't test now):
Nirsoft's Winprefetch View
Nirsoft's Last Activity View