Is there a way to see what was the last batch (something.bat) run on windows? I was in a folder which contains lots of batches, as I was opening them one by one by right clicking and selecting notepad++. I have a feeling that I could have clicked 'run as administrator' instead of clicking 'open with notepad++'. I am not sure though, therefore I was thinking if there is a way to see what bat file was last run on windows (and when). it is windows 2008 server. thanks for your help.
Windows doesn't have a simple log for started processes. One thing that comes close is the Registry key
It has entries for certain executed processes, the most interesting subkey is:
However those entries are ROT13 encoded. You could copy the value name and decode it manually. Instead you can use a tool that de-mystifies those entries, Didier Stevens' UserAssist
If you have a need for knowing about executed processes, you have at least two options to enable some logging. Of course this work only for future process starts:
The second one is easier to setup and most likely used less resources. However it only logs the start of a new process. This works fine if you double-click or
open a batch file in Explorer but wont log a batch execution if started from within cmd.exe