I am (finally) coding the script to determine when the last time a given piece of software was used. I have most of the executables determined for MS Office (see below), but am throwing open to everyone any executables you would like examined. If you would like something else, just post here and include the FULL path including the .exe name. I will add your item to the list below and delete your post (so as not to create a LONG list of posts, is all).
The attributes I am recording are "last accessed date" - IE, the last time it was run and also the extended attributes present on .exe's (File -> Properties -> Version -> ) "Product Name", "Product Version" and "Internal Version".
These attributes will be kept in a table in the database (sys_sw_software_used) seperate from the "installed software" table (sys_sw_software). The products do not correspond to what is installed. For example, most installs of Office will show up as "Microsoft Office XP Professional" or some such. Creating entries for "Microsoft Word XP", "Microsoft Excel 2007", etc, etc in the existing installed software table would not be accurate, prone to error and cause confusion.
Therefore, I do not want actual product names - just the full path. The product name will be determined from the attribute on the file (as above). ProductName - InternalName (or some combination thereof).
So, a couple of examples are:
[code]InternalName: Visio 2003
ProductName: Microsoft Visio
ProductVersion: 11.0
Date last accessed: 10/11/2011 4:56:17 PM
InternalName: Outlook
ProductName: Microsoft Office Outlook
ProductVersion: 11.0.8169
Date last accessed: 10/11/2011 4:26:47 PM
InternalName: WinWord
ProductName: Microsoft Office 2003
ProductVersion: 11.0.8169
Date last accessed: 10/11/2011 4:56:20 PM[/code]
Also of note is the fact that when a files attributes are read, this changes the date of "lastAccessed". Sigh. I'll have to do some clever stuff in the processing of the audit results like "If lastAccessed is within 5 minutes of the time the system was last audited, do not update this field in the DB". That way, we can read the lastAccessed date and if it set to the time of the last audit, then WE altered this by reading it last time. Disregard this timestamp and use the previous one. What a pain, but I don't see another way around this. I'm open to suggestions.
I have also attached a basic script to retrieve these details. Feel free to put some of your own path's in to it and test it out. NOTE - If you use a remote system in strComputer, make sure the user account you use to run the script has Admin access on the remote system. Rename the script to files.vbs and run it with cscript.
The different Office directories correspond to -
[code]Office 2000 - c:\Program Files\Microsoft Office\Office\
Office XP - c:\Program Files\Microsoft Office\Office10\
Office 2003 - c:\Program Files\Microsoft Office\OFFICE11\
- c:\Program Files\Microsoft Office\Visio11\
Office 2007 - c:\Program Files\Microsoft Office\OFFICE12\
Office 2010 - c:\Program Files\Microsoft Office\OFFICE14\[/code]
These are the files I am examining by default.
[code]C:\Program Files\Microsoft Office\Office\winproj.exe
C:\Program Files\Microsoft Office\Office10\msaccess.exe
C:\Program Files\Microsoft Office\Visio11\visio.exe
c:\Program Files\Microsoft Office\OFFICE11\excel.exe
c:\Program Files\Microsoft Office\OFFICE11\outlook.exe
c:\Program Files\Microsoft Office\OFFICE11\msaccess.exe
c:\Program Files\Microsoft Office\OFFICE11\powerpnt.exe
c:\Program Files\Microsoft Office\OFFICE11\winproj.exe
c:\Program Files\Microsoft Office\OFFICE11\winword.exe
c:\Program Files\Microsoft Office\OFFICE12\excel.exe
c:\Program Files\Microsoft Office\OFFICE12\outlook.exe
c:\Program Files\Microsoft Office\OFFICE12\powerpnt.exe
c:\Program Files\Microsoft Office\OFFICE12\visio.exe
c:\Program Files\Microsoft Office\OFFICE12\winword.exe
c:\Program Files\Microsoft Office\OFFICE14\excel.exe
c:\Program Files\Microsoft Office\OFFICE14\outlook.exe
c:\Program Files\Microsoft Office\OFFICE14\powerpnt.exe
c:\Program Files\Microsoft Office\OFFICE14\visio.exe
c:\Program Files\Microsoft Office\OFFICE14\winword.exe[/code]
| Attachments: |
files.txt [12.63 KiB]
Downloaded 456 times |
