Internet Explorer 11 Usage Audit
Security SoftwareList Internet Explorer 11 Usage
June 15, 2022 marks the end for Internet Explorer 11 for supported desktop Windows operating systems. To get a better understanding of how frequently Internet Explorer 11 is still used in your environment, the report below provides an overview of all the events scanned where the Internet Explorer process was created. Additionally, there is a chart report at the bottom of the page as well to help with manageability and for use in dashboards.
Internet Explorer 11 Usage Query
Select Distinct Top 1000000 tblAssets.AssetID, tblAssets.AssetName, tblAssets.Domain, tblAssets.Username, tblAssets.Userdomain, Coalesce(tsysOS.Image, tsysAssetTypes.AssetTypeIcon10) As icon, tblAssets.IPAddress, tsysIPLocations.IPLocation, tblAssetCustom.Manufacturer, tblAssetCustom.Model, tsysOS.OSname As OS, tblNtlog.Eventcode, tblNtlogSource.Sourcename, tblNtlogMessage.Message, tblNtlog.TimeGenerated, Case When tblErrors.ErrorText Is Not Null Or tblErrors.ErrorText != '' Then 'Scanning Error: ' + tsysasseterrortypes.ErrorMsg Else '' End As ScanningErrors, tblAssets.Lastseen, tblAssets.Lasttried From tblAssets Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype Inner Join tsysIPLocations On tsysIPLocations.LocationID = tblAssets.LocationID Inner Join tblNtlog On tblAssets.AssetID = tblNtlog.AssetID Inner Join tblNtlogMessage On tblNtlogMessage.MessageID = tblNtlog.MessageID Inner Join tblNtlogSource On tblNtlogSource.SourcenameID = tblNtlog.SourcenameID Inner Join tblState On tblState.State = tblAssetCustom.State Left Join tsysOS On tsysOS.OScode = tblAssets.OScode Left Join (Select Distinct Top 1000000 tblErrors.AssetID As ID, Max(tblErrors.Teller) As ErrorID From tblErrors Group By tblErrors.AssetID) As ScanningError On tblAssets.AssetID = ScanningError.ID Left Join tblErrors On ScanningError.ErrorID = tblErrors.Teller Left Join tsysasseterrortypes On tsysasseterrortypes.Errortype = tblErrors.ErrorType Where tblNtlog.Eventcode = 4688 And tblNtlogMessage.Message Like '%New Process Name:_C:\Program Files (x86)\Internet Explorer\iexplore.exe%' And tblAssetCustom.State = 1 Order By tblAssets.Domain, tblAssets.AssetName
Internet Explorer 11 Usage Query
The chart below provides an overview of the number of times Internet Explorer was started in the last 14 days.
Internet Explorer 11 Usage Chart Query
Select Distinct Top 1000000 tblAssets.AssetName, Count(tblNtlog.TimeGenerated) As Instances From tblAssets Inner Join tblNtlog On tblAssets.AssetID = tblNtlog.AssetID Inner Join tblNtlogSource On tblNtlogSource.SourcenameID = tblNtlog.SourcenameID Inner Join tblNtlogMessage On tblNtlogMessage.MessageID = tblNtlog.MessageID Where tblNtlog.TimeGenerated > GetDate() - 30 And tblNtlog.Eventcode = 4688 And tblNtlogMessage.Message Like '%New Process Name:_C:\Program Files (x86)\Internet Explorer\iexplore.exe%' Group By tblAssets.AssetName