Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In Windows, is there a log that records what programs were run/called?

While browsing the internet, viewing a static page with no ads, mouse clicks, keypresses, or miscellaneous plugins/addons/scripts running, I just saw a spontaneous CMD.exe console pop open and then immediately close in a flash, fast enough that I wasn't able to see anything in the window -- and with no apparent triggering on my part.

I'm wondering if there is some type of Windows log that shows what programs have been run/called/activated? I'd like to see what was happening behind the scenes when this console window flashed, and hopefully determine it wasn't something rogue.

For reference, I'm running Windows 7 Ultimate x64.

share|improve this question
    
Can improve the question. –  QMechanic73 Jun 3 '13 at 17:42
    
Was this on startup or were you installing something? –  Jan Doggen Jun 3 '13 at 19:53
    
I was merely browsing the internet -- and not even actively so. I was reading a static web page that had already loaded, with no clicks, keypresses, or requests being filed. I'm editing the question now to improve it, as I'm really asking if there is some type of log of program runs/initiations, and specifically, a command prompt. –  Coldblackice Jun 3 '13 at 21:01
    
Try to see in the event viewer of Windows. –  QMechanic73 Jun 3 '13 at 21:42
    
@JanDoggen It was in the middle of the day, nowhere near any startups, shutdowns, reboots, or installations. I was just reading in my browser in an already loaded page, with all popups/ads/scripts disabled, with no virus scans/updates scheduled. Additionally, I could see that it was a command prompt window that flashed and then disappeared. –  Coldblackice Jun 10 '13 at 5:19

4 Answers 4

You will not be able to check what ran, but you can prepare for the next time. If you open secpol.msc you can go to local policies/audit policy. Activate Success (and maybe also Failure) on "Audit process tracking" and you will get an event log entry in the security event log everytime a process starts or ends. Unfortunately you'll see the process that ran but not the command line it was started with. If you activate the auditing, a lot of logs might get generated, so you should adjust the size of the security event log.

share|improve this answer

It may have been a scheduled task running. Check the Task Scheduler for tasks.

You could also check the Event Viewer for anything, though it probably won't have anything.

share|improve this answer

By default Windows does not log every process it runs, but it can be made to do so. This link might prove useful to you: http://digirati82.com/2013/06/03/using-splunk-to-watch-for-new-binaries/

It goes into detail of how to log not only what process, but how to add MD5/SHA1 hashes of the Binary to the logs so you can see when it changes.

share|improve this answer

Mark Russinovich Sysinternals Process Monitor does that. Among tracking file/reg/network accesses, it can track proc/thread lifetime and allows a lot of filtering.

share|improve this answer
    
Would this have to have been running to capture a process that opened? Or is it able to report the thread lifetime independent of Procmon's tracking? –  Coldblackice Jun 5 '13 at 22:53
    
What "this" is independent of pmon? Do you mean monitoring without the monitor? How do you imagine this? –  Val Jun 6 '13 at 6:51
    
What I meant -- would Process Monitor needed to have been running in order to track proc/thread lifetime, or is that globally stored independent of Process Monitor? –  Coldblackice Jun 28 '13 at 5:27
    
Process Monitor is what it says -- a monitor. It is not Windows Log Viewer. It injects some drivers into the windows core functions and logs the calls himslef. You cannot monitor without the monitor. Ok? –  Val Jun 28 '13 at 5:51
    
Oops -- I was confusing Process Monitor with Process Explorer -- Process Explorer can see process start/running times without having been active (monitoring) when the respective program was first started. I thought it was Process Explorer you were talking about. Thanks. –  Coldblackice Jul 4 '13 at 22:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.