You can turn on event auditing, through the group policy editor to log every instance of a program being run and then filter the results from the system log using a third-party tool. The exact event you would be looking for is "Audit process tracking," which tracks all executables. Be sure to turn this on for both failure and success to get the most comprehensive logging possible.
Dig deeper on Enterprise Infrastructure Management
Related Q&A from Serdar Yegulalp, WinIT
Frustrated admins have been dealing with extend.dat error messages since Outlook 97. Our expert sheds some light on this all-too-common Outlook error.continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.