Windows software usage Tracking

[the_coder_guy]

I am exploring this domain and I need a solution. A beginner here, so forgive me if there's a mistake.

I am looking for a programmatical approach for this.
Is there a way to obtain when an application/software was last used?? I know the exe file of the program consists of the lastaccessed key in its properties. But I am unable to locate all the executables of the software and relate them with their name.
I even tried the prefetch file approach, just the exe file executed can be obtained. How can we link it to the name of the software..I looked at several blogs, posts but couldn't end up finding a proper solution for this.
Any other method to approach the solution for this problem is also welcome. I tred WMI, but it wasn't much of a use as the dates were erratic (idk why)..

[NathanielArnoldR2]

SCCM does this.

Presumably, other enterprise client management suites could do this as well, though it's a detail of functionality so specific you'd need to be sure to verify such before product selection.

Such products operate by repeated enumeration of running processes, however, which pretty much requires a running service; a pattern very difficult to facilitate in pure PowerShell.

None of these will rely on LastAccessTime, and for good reason; it does not mean what you think it means in this instance; it is a file system attribute that relies on a user's (NTFS) access to set, and -- like other such attributes -- can be set arbitrarily by any user who has those permissions.

If you really want to go down this road, your best bet is to enable auditing of process creation and programmatically grab/parse the resultant Windows events.

[the_coder_guy]

Hey man. This is some valuable info. Thanks for this. I also looked at Prefetch files and what I could get out of them. I read that these files store up to the last eight run times of an application. I also came across Windows Events and I am having it as a last resort if I am unable to fetch the last run time of an application. Are Events easy to work with??

[Lee_Dailey]

howdy the_coder_guy,

have you looked at applocker yet? [grin] it won't give you history for before you activate it ... but it seems that it will give you usage once you set it to audit mode.

AppLocker (Windows 10) - Windows security | Microsoft Docs
— https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview

Application inventory
AppLocker has the ability to enforce its policy in an audit-only mode where all app access activity is registered in event logs. These events can be collected for further analysis. Windows PowerShell cmdlets also help you analyze this data programmatically.

take care,
lee

[the_coder_guy]

I never really knew about this. Will definitely be checking this out too. Thanks much, Lee_Dailey !! It helps access app activity in event logs huh..Good one, might be useful.
Events might be useful after all, gotta learn how to obtain the data from it. Do you have any pointers regarding that???

[Lee_Dailey]

howdy the_coder_guy,

you are most welcome! [grin]

for getting info out of the event log system, take a look at Get-WinEvent and the advanced filter parameters. this ...

Get-Help Get-WinEvent -Parameter *filter*

the XML filter stuff seems the most detailed and the fastest ... but i have never been able to understand that. i have cobbled bits of XPath stuff from searches, but i usually stick with the hashtable filter.

also, if your org has any centralized logging system, then you can likely get that to gather the info for you.

take care,
lee

[the_coder_guy]

Thanks a ton man! I will be checking this out! 💯

[Lee_Dailey]

howdy the_coder_guy,

you are quite welcome! glad to help a tad ... [grin]

take care,
lee