How can I find out which users have launched Microsoft Office Applications

[smithjl]

My CIO has requested a report that shows each user (or at least the number of users) that has launched an application, specifically any application in the Microsoft Office Suite. I'm not sure where to begin to generate this report. Does anyone in the community have any tips that can help me fulfill this request?

[smithjl]

Thank you for your help. This gave me a starting point and it is greatly appreciated. We decided to do this by using a different tool.

[wmyersas · Accepted solution]

I don't have Windows events available to look at, but it appears you can look for a Security Event 4668, then filter based on Office apps (Excel, Winword, etc)

refs:

• https://www.windows-security.org/windows-event-id/4668-an-application-was-initialized
• https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4668
• https://www.manageengine.com/products/active-directory-audit/kb/object-access-events/event-id-4668.h...
• https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor
• https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/MonitorWindowseventlogdata