4
I would like to understand how my computer is being used. I could use something like ManicTime, but it seems like this information should also be in the event log somewhere. Is it? If not, is there another place to get/capture this information?
Steve Rowe
Posted 2014-09-07T07:05:28.700
Reputation: 3 729
5
In windows you can set the policy of security to record every operation, like (login, logout) or erasing stuff in your computer like files or folders.
Use the "run" program with the Win + R and type "gpedit.msc" without quotes.
Then navigate through:
Computer configuration → Windows configuration → security configuration → advanced audit
I'm in a Spanish version of windows so name can differ, look at the picture for more info.
After you set the policy as you want just reboot your computer, every policy triggered will be showed in the "event viewer".
Alejandra Moreno
Posted 2014-09-07T07:05:28.700
Reputation: 682
2English screenshot for reference. Note that the Group Policy Editor requires a Business/Professional/Enterprise/Ultimate edition of Windows. – Bob – 2014-09-07T14:40:07.083
Is there an option for non-pro versions of Windows? – Steve Rowe – 2014-09-07T21:51:55.063
1@SteveRowe Officially? No. IIRC most group policy options map to registry entries, and MS releases spreadsheets detailing the mappings, but I'm not sure if that applies to the audit options too. You might be stuck looking for a third-party alternative. – Bob – 2014-09-08T05:20:23.317