Application logging

[BingBangBop]

Is there an inexpensive Windows application in the form of a service that will timestamp to a text file when every new application starts and stops running, the pathname of the executable and the username who initiated the program? I do not want it at the process or thread level (too much detail) but just at the actual application level. The name and location of the text file needs to be configurable to a networked fileshare location.

Seems to me this would be a very basic security logging capability that should be built into Windows but as far as I can tell isn't.

 

[Mercutio]

You could audit for file access, though that won't tell you when usage stops.

 

[BingBangBop]

I need the stop time too.

 

[Mercutio]

Could you maybe get away with using parental monitoring software?

 

[BingBangBop]

possibly, I'm researching them right now.

 

[Mercutio]

I've found that they can be PAINFUL to implement. They're very intrusive on business machines and you'll really have to work with the vendor if you go that route.

 

[Handruin]

This product you seek would need to contain some kind of look-up table to associate a process to an application because that is of course what the application is (a basic running process or processes). I understand you do not want process level, so that's why a conversion would be required.

I don't know if you're the kind to roll your own software, but there is a basic framework here that may cover some of what you're looking for through the use of WMI events. A reference database (look-up) would need to be added to convert the process name to an easy to read application name. There may be some creative ways to poll online spyware websites to do this conversion for you. Logging the events to the format you requested sounds very doable. The user interface could give you a way to register an application name to a process or set of processes and for the ones which start/stop without a known application name, it could prompt you for interaction. Just some ideas...