Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.
Sign up to join this community
Let's say I executed 5 batch files yesterday and now I want to know the order of the execution of the files. Does Windows log the execution, maybe in Windows Event Logs or something? Or is there any third party program that does so?
This could be useful if there is a malicious batch file that executed accidentally by the user or automatically by the batch file itself and we want to know the name of the file, where is it located so that we can remove it.
AFAIK Windows command-line don't have persistent command history.
You can try Clink. History persistence between sessions is one of its futures.
You don't specified which Windows you are using but...
You may try Windows Audit Policy: Audit process tracking policy:
This policy setting enables auditing of detailed tracking information for events such as program activation, process exit, handle duplication, and indirect object access.
Success audits generate an event when the process being tracked succeeds. Failure audits generate an event when the process fails.
If you enable Audit process tracking in Windows Vista and Windows Server 2003 with SP1, Windows will also log information about the operating mode and status of the Windows Firewall component.
When enabled, the Audit process tracking setting generates a large number of events. This policy setting is typically configured to No Auditing. However, the information that this policy setting generates can be very beneficial during an incident response because it provides a detailed log of the processes that were started and when they were started.
How to set up a file audit on Windows server? with references may be a good starting point to setup Audit process tracking, but feel warned that it might be CPU expensive.
