2

Is there a way to see what was the last batch (something.bat) run on windows? I was in a folder which contains lots of batches, as I was opening them one by one by right clicking and selecting notepad++. I have a feeling that I could have clicked 'run as administrator' instead of clicking 'open with notepad++'. I am not sure though, therefore I was thinking if there is a way to see what bat file was last run on windows (and when). it is windows 2008 server. thanks for your help.

3

Windows doesn't have a simple log for started processes. One thing that comes close is the Registry key UserAssist:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

It has entries for certain executed processes, the most interesting subkey is:

{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count

However those entries are ROT13 encoded. You could copy the value name and decode it manually. Instead you can use a tool that de-mystifies those entries, Didier Stevens' UserAssist

If you have a need for knowing about executed processes, you have at least two options to enable some logging. Of course this work only for future process starts:

The second one is easier to setup and most likely used less resources. However it only logs the start of a new process. This works fine if you double-click or open a batch file in Explorer but wont log a batch execution if started from within cmd.exe

| improve this answer | |
0

Try Event Logs. Click Start and type "event logs". Under "Windows Logs" on the left, click "Application".

The batch file would need to have specific code that dumps an exception or completed message in the logs. If not, you may be out of luck.

| improve this answer | |
  • How many batch files have you ever seen that report to the event log? Very unlikely. – Peter Hahndorf May 12 '15 at 6:02
0

One of the following should give you that (can't test now):
Nirsoft's Winprefetch View
Nirsoft's Last Activity View

| improve this answer | |
  • Non of these tools show the execution of binaries or batches, – Peter Hahndorf May 12 '15 at 10:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.