I'm pretty sure the answer to my question is a simple "No", but I'm going to try it anyways. (And a plain No would help me also.)

We've got a shared computer. Folks may use it as they do, but they won't do more than Googling or sending mails.

Today someone executed a batch file, took his USB stick off and went away.

There is no damage done. I'm just curious if there is a way to see what has been in this batch file. If this is plain source code or just "it MAY have done these things" doesn't matter.

Maybe Windows keeps some tracking? But I never saw this. The user account is a domain account from a Windows Server 2003. Maybe this one keeps tracking?

Is there a way to find out what batch files recently have executed?

Windows 7
User account is accessed over domain
Hasn't been shut down since then
  • The question is to broad. The batch file is just a list of shell commands. Those commands could have been anything. Depending on the contents of the batch file the commands that were executed may or may not have been logged somewhere within the system log. However I don't know of the way to trace it back to the actual batch file – Art Gertner Apr 20 '15 at 10:51
  • 1
    As you suspected, the answer in this case is indeed No. – Karan Apr 20 '15 at 11:03
  • There are programs like "process monitor" and uninstallation programs, but if you didn't make preparations before the batch file was run, then no. – barlop Apr 20 '15 at 11:27

Windows does not keep detailed logs about what applications were run and by whom. You can set up auditing on filesystem objects, and the security log does track logon events and privilege use. But the security log doesn't contain the info you're looking for and auditing would have had to have been set up beforehand.

Even if you had auditing set up, Windows wouldn't have kept a copy of the BAT file for you to look at, so you still wouldn't know exactly what it did.

If you are concerned about such activity in the future, I would recommend you use Group Policy to whitelist specific applications that users are be allowed to run on this machine. If that's too restrictive, then at least block script execution and command line access. That should prevent users from running scripts with extensions like .bat, .cmd, .vbs, .js, etc.

  • This is what I thought, too, as I didn't know any way to reproduce it. Well, at least that helped me a lot, thanks for that! :) – Trollwut Apr 20 '15 at 11:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.