0

I just saw a new application appear briefly on taskbar and disappear immediately, without any input from me. How do I find what it was? What logs should I look at?

1
  • Experienced Linux user here, console command OK. Oct 24, 2018 at 20:42

2 Answers 2

1

You need to be prepared ahead of time. Logging all applications can generate a lot of log data and so that level of logging is not the default. Here is a good answer on this topic in another. If @WernerHenze answer works for you you should upvote it.

You will not be able to check what ran, but you can prepare for the next time. If you open secpol.msc you can go to local policies/audit policy. Activate Success (and maybe also Failure) on Audit process tracking and you will get an event log entry in the security event log every time a process starts or ends. Unfortunately you'll see the process that ran but not the command line it was started with.

If you activate the auditing, a lot of logs might get generated, so you should adjust the size of the security event log.

You can access the logs with eventvwr.msc, Windows protocols, Security.

0

Windows doesn't keep a history of when applications were running by default you will have to set this up before hand. However in certain cases you might be lucky to find the application using the event viewer.

1
  • Is setting up win application logging easy?
    – Xen2050
    Oct 25, 2018 at 7:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .