Getting Data In

Logging windows application usage

beezly
Explorer

Is there a way I can use Splunk to log Windows application usage?

I need to be able to see what applications were launched during a users session.

Tags (2)
0 Karma

farleymike
Explorer

You can enable process tracking via Group Policy (local or domain based).

http://technet.microsoft.com/en-us/library/cc775520(v=ws.10).aspx

Once enabled an event is logged to the Windows Security Event Log when a process is started/terminated. However, be aware that process tracking does generate a lot of events!

beezly
Explorer

Exactly what I needed. Thanks very much.

0 Karma

beezly
Explorer

So far I've discovered that this isn't a standard piece of information that gets copied into the Windows Event Log. At the moment we're thinking that we might need to write a piece of code which will drop that information into the event log.

There's an article at http://www.codeproject.com/Articles/2018/Detecting-Windows-NT-2K-process-execution which explains some of the background of running a callback function each time a process is created or destroyed.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...