Can you see who installed a program?

Discussion in 'Windows Desktop Systems' started by Jewelzz, Mar 30, 2007.

  1. Jewelzz

    Jewelzz OSNN Godlike Veteran

    Messages:
    10,977
    Location:
    California
    Can I find out who installed FF on a PC? Employees are work keep installing it and I want to know who it is.
     
  2. Cilix

    Cilix OSNN Junior Addict

    Messages:
    29
    Location:
    Long Island, NY
    Are you in a domain enviroment?

    EDIT: I can see the only way to do it natively in Windows is to check the registry:

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe

    Hopefully, you will find the FF exe file in the MRU list underneath the users documents and settings path. And tada, you nailed them.

    If you dont find it there, I can do some investigation into a monitoring software which will do the trick.
     
    Last edited: Mar 30, 2007
    Jewelzz likes this.
  3. LordOfLA

    LordOfLA Godlike!

    Messages:
    7,027
    Location:
    Maidenhead, Berkshire, UK
    see who owns the file in sharing and security.
     
    Jewelzz likes this.
  4. lancer

    lancer There is no answer! Political User Folding Team

    Messages:
    3,093
    Location:
    FL, USA
    wont it show up in the event log and which user was logged on when that happened?
     
    Jewelzz likes this.
  5. zeke_mo

    zeke_mo (value not set) Staff Member Political User Folding Team

    Messages:
    1,984
    Location:
    Placerville, CA
    whats wrong with FF? :cry:
     
  6. Jewelzz

    Jewelzz OSNN Godlike Veteran

    Messages:
    10,977
    Location:
    California
    I'll check the regedit next time I find it installed. I can't install anything that isn't company approved.

    Where's that? :s
    Not sure where to look
    Nothing except my employees are suppose to be working and not surfing the net AND they are not suppose to be installing any software!
     
  7. zeke_mo

    zeke_mo (value not set) Staff Member Political User Folding Team

    Messages:
    1,984
    Location:
    Placerville, CA

    Those jerks...
     
  8. LordOfLA

    LordOfLA Godlike!

    Messages:
    7,027
    Location:
    Maidenhead, Berkshire, UK
    Right click the file/folder and chose properties, then security tab. The person that created the file will be one of the listed accounts with access authorisation.

    Change their accounts to power user or limited user in control panel > user accounts or hire a consultant to setup a small active directory network bases on microsoft small business server 2003.
     
  9. LeeJend

    LeeJend Moderator

    Messages:
    5,291
    Location:
    Fort Worth, TX
    Lord
    I know what you said is true because that's the way our XP desktops at work are but I can't find the owner for folder on my machines at home.

    Is there a setting I missed somewhere? I have accounts and passwords on. I did not set Windows to make accounts private. Would that be the difference?

    Jewelzz
    I just spent a few hours looking for a script to get the who installed info and 2000, XP, and server 2003 do not support the "owner" info in the install data so that path is a dead end. I also scanned my registry out of curiosity and only one out of 30 programs I looked at had "owner" info stored for it.

    It looks like locking down the systems tighter is your best bet. You could also write a script that will scan each computer daily and list all installed software. That much I did find. Let me know if you want it. You could also write a script to remove FF on an hourly basis to annoy the culprit...

    PS Thanks. This project tied in nicely with brushing up on my scripting skills which I need for work soon.
     
    Jewelzz likes this.
  10. American Zombie

    American Zombie Moderator Staff Member Political User

    Messages:
    2,934
    Location:
    Seattle
    Simple way to me would be to just go into the FF folder and right click any of the files and see the created time/date. Next, go into event viewer > security and see who was logged in at that time.
     
    Jewelzz likes this.
  11. Brad

    Brad Moderator Political User Folding Team

    Messages:
    2,280
    Location:
    Cary, NC
    Must be a joyful place to work...
     
  12. Shamus MacNoob

    Shamus MacNoob Moderator Political User

    Messages:
    4,199
    Location:
    L'Ile Perrot Quebec
    There is a way to stop them from installing anything at all and stop them from doing many things unwanted by using group policy editor .
     
    Jewelzz likes this.
  13. Jewelzz

    Jewelzz OSNN Godlike Veteran

    Messages:
    10,977
    Location:
    California
    The PC is locked as much as possible (we have a desktop group that handles that, I can't do much more), the staff do need some access as we use a monitoring tool that runs off the net and needs to be able to have a popup. I'm pretty sure I know who installed FF the last time but I was so pissed it had been installed (right after it was re-imaged) that I simply uninstalled it without looking.
     
  14. Jewelzz

    Jewelzz OSNN Godlike Veteran

    Messages:
    10,977
    Location:
    California
    You sound just like my staff, you're hired!
     
  15. Perris Calderon

    Perris Calderon Moderator Staff Member Political User

    Messages:
    12,332
    Location:
    new york
    this is probably suggested before, I haven't read all the answers

    anyway, search for the .exe, hit properties, go to general, it will tell you when it was last accessed, then check the logs for who was on the computer at that time
     
    Jewelzz and Vanquished like this.
  16. Cilix

    Cilix OSNN Junior Addict

    Messages:
    29
    Location:
    Long Island, NY
    You should be yelling at these people then. If they manage the workstations and they allow users free roam like that, it just opens the door for any number of different threats.
     
    Jewelzz likes this.
  17. Jewelzz

    Jewelzz OSNN Godlike Veteran

    Messages:
    10,977
    Location:
    California
    Thanks for all the suggestions fellas :) If the company doesn't care I won't care either. You know my motto, "just say fu*k it" :p
     
  18. Jewelzz

    Jewelzz OSNN Godlike Veteran

    Messages:
    10,977
    Location:
    California
    Reps to all who helped, thanks
     
    Perris Calderon likes this.