I have searched Google with several search terms, attempting to discover if Windows logs when a user attempts to run an application that is not whitelisted, and if so, in what event log.

Can anyone shed some light on this?

Edited to add detail: I am talking about a Whitelist with exceptions to a Software Restriction Policy created in the Group Policy Editor. If a user has permission to run only two executables (foo.exe, and bar.exe) and tries to run a third executable (grapes.exe), will that attempt to run the third be logged, and if so, what is the information logged, and where is it logged?


1 Answer 1


I'm not sure what you mean by "White Listed" in Windows but this Operating System does save log files when a program opens.

Bellow is a list of some directory's in Windows with Log information.

Windows Explorer

Description: Recently opened files from Windows Explorer Location: C:\Users\\AppData\Roaming\Microsoft\Windows\Recent Items Why you care: It can be quite useful to know what files have been opened recently. Think someone is accessing records of embezzlement? Maybe there is a pointer to the Excel file here that can lead you to where the data has been stored. You may also see links to videos and images in here. I've had this lead to personal embarrassment before while doing a presentation for the ISSA. :) Entry by: Irongeek, but thanks to Nir.

Description: Items recently ran from the "Run" bar Location:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU Why you care: Useful to know what the person is running using the Windows Run bar, but in Vista and Windows 7 lots of folks use "Search programs and files" text box, which does not show up in this registry key. Entry by: Irongeek, but thanks to Nir.

Description: User Assist Location: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist Why you care: This key is suppose to contain information about programs and shortcuts accessed by the Windows GUI, including execution count and the date of last execution, but the way it's stored is less than obvious. Didier Stevens has a tool far parsing the data here: http://blog.didierstevens.com/programs/userassist/ The version I tested does not seem to work in Windows 7, but Mr. Stevens is on the case. Entry by: Irongeek, but thanks to Nir and Didier Stevens.

Description: Event logs Location: Should be in C:\Windows\System32\config or C:\Windows\System32\winevt\Logs depending on OS Why you care: These may be relocated, so do a desktop search for *.evt and *.evtx. Let you know all sorts of things about what is happening on the box. Entry by: Irongeek.

This information was pulled from Irongeeks, you can search for "UserAssist Didier Stevens" if you would like a GUI program to view opened programs.

Please note that I cannot post a link to these two things because I will be accused of Spamming and promoting a website.

  • This does not cover everything that a user might've executed on the system. For instance, if a command-line tool was run within cmd, it wouldn't show up anywhere
    – Vinayak
    Commented Jan 30, 2015 at 17:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .