Audit and application's execution

  • Thread starter Thread starter Sebas
  • Start date Start date
S

Sebas

Hi,

I'd like to audit on a W2000 workstation if an application
was used - opening and closing time.

I know it's possible to audit a service this way.

how can I do the same with an app?

Thanks

Sebastien
 
You can enable auditing of object access and then set auditing of the executable
in properties/security/advanced/auditing/execute file. However that may not give
you a closing time - you will need to test it out, and try to use minimum amount
of groups or users to audit instead of everyone to keep events generated down.
You could also enable auditing of process tracking, however that will generate
huge amounts of events in your security log for that computer. You also will
want to substantially increase the size of the security log from default. ---
Steve
 
Hi,

Thanks for your tips, but I've already tryied all that. The execute file
auditing doesn't give a closing time, and the process tracking gives way to
much information!

I'm all ears if you have another suggestion!!

Take Care!

Sebas
 
Back
Top