Audit Process Creation Event Audit
Miscellaneous SoftwareList Audit Process Creation Events
The Windows event log contains all sorts of information about your Windows devices from login data to errors generated on the computer. By default, Lansweeper will scan all the error events generated by the Windows computer. Additionally, you can enable scanning other event log information. The report below lists specifically all of the events with ID 4688 for the process “zoom.exe” and requires you to enable the scanning of success events. The report allows you to get all the details about the Zoom software creation processes and is the basis for doing software usage monitoring with Lansweeper. You can find more information about this use case in the Pro Tips 46 blog post.
This report requires you to enable success audit event scanning.
You can adjust the software this report focuses on by adjusting “zoom.exe” to the software package you want to monitor.
Audit Process Creation Event Lansweeper On-Prem Query
Select Top 1000000 tblAssets.AssetID, tblAssets.AssetName, tblAssets.Domain, tblAssets.Username, tblAssets.Userdomain, Coalesce(tsysOS.Image, tsysAssetTypes.AssetTypeIcon10) As icon, tblAssets.IPAddress, tsysIPLocations.IPLocation, tblAssetCustom.Manufacturer, tblAssetCustom.Model, tsysOS.OSname As OS, tblNtlog.Eventcode, tblNtlogSource.Sourcename, tblNtlogMessage.Message, CONVERT(DATE, tblNtlog.TimeGenerated) AS DateGenerated, Case When tblErrors.ErrorText Is Not Null Or tblErrors.ErrorText != '' Then 'Scanning Error: ' + tsysasseterrortypes.ErrorMsg Else '' End As ScanningErrors, tblAssets.Lastseen, tblAssets.Lasttried From tblAssets Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype Inner Join tsysIPLocations On tsysIPLocations.LocationID = tblAssets.LocationID Inner Join tblNtlog On tblAssets.AssetID = tblNtlog.AssetID Inner Join tblNtlogMessage On tblNtlogMessage.MessageID = tblNtlog.MessageID Inner Join tblNtlogSource On tblNtlogSource.SourcenameID = tblNtlog.SourcenameID Inner Join tblState On tblState.State = tblAssetCustom.State Left Join tsysOS On tsysOS.OScode = tblAssets.OScode Left Join (Select Distinct Top 1000000 tblErrors.AssetID As ID, Max(tblErrors.Teller) As ErrorID From tblErrors Group By tblErrors.AssetID) As ScanningError On tblAssets.AssetID = ScanningError.ID Left Join tblErrors On ScanningError.ErrorID = tblErrors.Teller Left Join tsysasseterrortypes On tsysasseterrortypes.Errortype = tblErrors.ErrorType Where tblNtlog.Eventcode = 4688 And tblAssetCustom.State = 1 and Message like '%zoom.exe%' Order By tblAssets.Domain, tblAssets.AssetName