RE: Windows XP software history

["Murda Mcloud" <murdamcloud () bigpond com>]

Also, the event viewer may give clues by searching under Application where
MSIInstaller is the Source. Sometimes the USER will be listed. Sometimes it
just says system.

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On
Behalf Of ????????
Sent: Friday, May 04, 2007 4:27 PM
To: Razorren; security-basics () securityfocus com
Subject: Re: Windows XP software history

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Heloo, Razorren.

You wrote 3 may 2007 , 18:04:17:

R> Is there a way to see which user account in XP or WIN2003 installed
R> or removed a piece of software?
Built-in - turn on audit for needed directories and/or registry hives.
Another way - use other software to monitor changes.

If installing or deleting olready done - you can look for the owner of
the new/lasted files on ntfs drives.

- --
WBR,                         phoneto: +79052049787
 Vladimir                          mailto:vai () pcrescue ru

-----BEGIN PGP SIGNATURE-----
Version: PGP SDK 3.7.2
Comment: ""

wj8DBQFGOtIw5krMlTo7DKsRAu6dAKC0CL4Ip2CYoUonaGo6l7vufQC1uACg9yfq
dIjk4v0X7oq04nNchr6bMyw=
=cL9+
-----END PGP SIGNATURE-----