Re: how to find out who installed software

As Roger mentioned take a look at the ownership of the folder for that
application and also look at the time the folder was created which may
provide a clue. You could then look in the security log for logon/account
logon events and their corresponding time/dates that may help you narrow the
list of suspects. You could also try giving administrators deny NTFS
permissions to the program folder after enabling auditing of object access
and enabling auditing on the folder to see if you can flush out the user if
he attempts to change permissions to gain access to it again and also audit
the executabe file for the program. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;300549 --- enable
folder auditing.

"mtler" <mtler@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:FD4D375A-9A70-4654-8E34-704FFEE934AF@xxxxxxxxxxxxxxxx
I'm trying to figure out who installed Firefox on Windows 2000 server.
There
are few users with administrative privileges to that server. Firefox is
listed in Ad/Remove programs. Is there a way to determine who installed
the
software?
Thank you.


.

Relevant Pages

  • Re: Security on a user folder
    ... Enabling auditing is a 2-part process. ... as you've done in your GPO. ... you also need to enable auditing on ... > is there a way to set up some type of monitoring on just one folder? ...
    (microsoft.public.win2000.security)
  • Re: Auditing folder moves
    ... I tried it out on a W2K server locally and I found that after enabling auditing of ... both delete permissions that when I moved a sub folder named ... administrator. ...
    (microsoft.public.win2000.security)
  • Re: Multiple user groups and permissions
    ... > Advice in this forum talks about adding program shortcuts to the All ... > to hand out change permissions to limited users. ... Start Menu folder and Desktop folder shortcuts from the user profile ... limited accounts, you can fix it to allow limited users to access the ...
    (microsoft.public.windowsxp.general)
  • Re: Folder reappeares on desktop
    ... Enabling auditing of object access generates a lot of system events such as those ... I would be looking for an Event ID 560 for the parent folder where the ... security log when that happens but it is worth a try. ...
    (microsoft.public.win2000.security)
  • Re: How to Audit windows 2003 folder secrity setting change?
    ... First use Local Security Policy or the domain/OU Group Policy ... that enforces that setting or auditing of object access. ... object name is a folder called log on drive E. Under accesses note ...
    (microsoft.public.windows.server.security)