Question about application history on Win7

Does Windows 7 (or any version of Windows) save a history list of programs
run on the machine? I'm looking for a way to find out which programs ran on
my machine this past Saturday, and what time they were executed.

On 1/23/2012, KCB posted:
> Does Windows 7 (or any version of Windows) save a history list of programs
> run on the machine? I'm looking for a way to find out which programs ran on
> my machine this past Saturday, and what time they were executed.

All I know is that you can buy software to accomplish this and related
tasks, but obviously that won't help you with prior events.

--
Gene E. Bloch (Stumbling Bloch)

KCB wrote:
> Does Windows 7 (or any version of Windows) save a history list of
> programs run on the machine? I'm looking for a way to find out which
> programs ran on my machine this past Saturday, and what time they were
> executed.

In 7 and Vista, some recently used programs are listed in the start
menu, and there's a list of the most recently used programs and
documents in the registry, but the list is fairly short, with no times
attached. Some firewalls keep logs of which programs access the network
and when.

For documents that might have been modified, you can check the
properties to find out when the files were last marked as modified by
checking the properties in Explorer.

Other than that, no, unless you install logging software, which can't
log stuff that happened before it was installed.

--
Tciao for Now!

John.

In message <>, John Williamson
<> writes:
>KCB wrote:
>> Does Windows 7 (or any version of Windows) save a history list of
>>programs run on the machine? I'm looking for a way to find out which
>>programs ran on my machine this past Saturday, and what time they were
>>executed.
[]
>For documents that might have been modified, you can check the
>properties to find out when the files were last marked as modified by
>checking the properties in Explorer.
[]
.... which might thus indicate what was used to modify them - if a .doc
or .docx file, for example, it was probably Word.

I presume you're trying to find what caused something on your machine on
Saturday - perhaps tell us more and we might be able to help more?
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G.5AL-IS-P--Ch++(p)Ar@T0H+Sh0!:`)DNAf

Rather, she's like many educated people of her generation: modern enough to be
seduced by the sheer human interest of celebrity and popular culture, yet
traditional enough to feel bad about the seduction. - Robert Crampton on
Vanessa Feltz, Radio Times 15-21 January 2011

On 23/01/2012 23:07, KCB wrote:
> Does Windows 7 (or any version of Windows) save a history list of programs
> run on the machine? I'm looking for a way to find out which programs ran on
> my machine this past Saturday, and what time they were executed.
>
Anything useful in Event Viewer?

--

Jeff

KCB wrote:

> Does Windows 7 (or any version of Windows) save a history list of programs
> run on the machine? I'm looking for a way to find out which programs ran on
> my machine this past Saturday, and what time they were executed.

Well, did you beforehand enable audit policies for process tracking?

gpedit.msc
node: Computer Configuration -> Windows Settings, Security Settings ->
Local Policies -> Audit Policy
setting: Audit process tracking

"J. P. Gilliver (John)" <> wrote in message
news:...
> In message <>, John Williamson
> <> writes:
>>KCB wrote:
>>> Does Windows 7 (or any version of Windows) save a history list of
>>> programs run on the machine? I'm looking for a way to find out which
>>> programs ran on my machine this past Saturday, and what time they were
>>> executed.
> []
>>For documents that might have been modified, you can check the properties
>>to find out when the files were last marked as modified by checking the
>>properties in Explorer.
> []
> ... which might thus indicate what was used to modify them - if a .doc or
> .docx file, for example, it was probably Word.
>
> I presume you're trying to find what caused something on your machine on
> Saturday - perhaps tell us more and we might be able to help more?

One of my email accounts got hacked, and I was thinking maybe some rogue
program on my computer. Hopefully, this is not the case, as my computer was
off at the time the emails were (apparently) sent. My employer was closed,
with no access to my work computer, so I don't think anything happened
there, either. It seems from the headers, if they can be believed, that the
originating computer was in Israel, and other than my name and email
address, there is nothing else in the source that points to anything related
to me. I'm still baffled how they did it.

"VanguardLH" <> wrote in message
news:jfmsir$ovd$...
> KCB wrote:
>
>> Does Windows 7 (or any version of Windows) save a history list of
>> programs
>> run on the machine? I'm looking for a way to find out which programs ran
>> on
>> my machine this past Saturday, and what time they were executed.
>
> Well, did you beforehand enable audit policies for process tracking?
>
> gpedit.msc
> node: Computer Configuration -> Windows Settings, Security Settings ->
> Local Policies -> Audit Policy
> setting: Audit process tracking

Thanks for this information. I did not have this enabled, but will surely
check these options to see what I can track.

"Jeff Layman" <> wrote in message
news:jfmiqe$3n8$...
> On 23/01/2012 23:07, KCB wrote:
>> Does Windows 7 (or any version of Windows) save a history list of
>> programs
>> run on the machine? I'm looking for a way to find out which programs ran
>> on
>> my machine this past Saturday, and what time they were executed.
>>
> Anything useful in Event Viewer?

Not anything that I could see at the time this occurred. Earlier and later
entries, from legitimate Win7 services, did have me studying those for quite
a while.

In message <jfn9hu$394$>, KCB <>
writes:
[]
>One of my email accounts got hacked, and I was thinking maybe some
>rogue program on my computer. Hopefully, this is not the case, as my
>computer was off at the time the emails were (apparently) sent. My
>employer was closed, with no access to my work computer, so I don't
>think anything happened there, either. It seems from the headers, if
>they can be believed, that the originating computer was in Israel, and
>other than my name and email address, there is nothing else in the
>source that points to anything related to me. I'm still baffled how
>they did it.

When you say your account got hacked, and you mention headers - do you
just mean that someone sent an email that seemed to come from you (which
whoever received it subsequently told you about)? Or something more
serious, someone hacked into your account and read your emails
(presumably a web-based or similar type - maybe the hotmail you're
hiding - since your PC was off at the time)?

If it's just spoofed From: headers, don't worry - there's nothing you
can do about that and nothing you've done wrong (or carelessly) to cause
it.
--
J. P. Gilliver. UMRA: 1960/<1985 MB++G.5AL-IS-P--Ch++(p)Ar@T0H+Sh0!:`)DNAf

A 30-second chat in the corridor can be worth a thousand emails. - Edward
Hallowell, Toronto psychiatrist (quoted in Computing, 1999-2-18 p. 27)