How to Detect Who Installed What Software on Your Windows Server

{{ firstError }}
We care about security of your data. Privacy Policy
Native Auditing Netwrix Auditor for Windows Server
Native Auditing
Netwrix Auditor for Windows Server
Steps

 

  1. Run eventvwr.msc → Windows Logs → Right-click "Application" log → Properties:
    • Make sure the "Enable logging" check box is selected
    • Increase the log size for at least 1gb
    • Set retention method to "Overwrite events as needed" or "Archive the log when full".
  2. Open Event viewer and search the application log for the 11707 event ID with MsiInstaller Event Source to find latest installed software.
  3. To create an instant alert that is triggered upon any software installation, you need to edit the following powershell script by setting your parameters up and saving it anywhere as .ps1 file (e.g., detect_software.ps1):

#Mail SMTP Setup Section
$Subject = "New Software Has Been Installed on $env:COMPUTERNAME" # Message Subject
$Server = "smtp.server" # SMTP Server
$From = "From@domain.com" # From whom we are sending an e-mail(add anonymous logon permission if needed)

$To = "to@uncc.edu" # To whom we are sending
$Pwd = ConvertTo-SecureString "enterpassword" -AsPlainText –Force #Sender account password
#(Warning! Use a very restricted account for the sender, because the password stored in the script will be not encrypted)
$Cred = New-Object System.Management.Automation.PSCredential("From@domain.com" , $Pwd) #Sender account credentials

$encoding = [System.Text.Encoding]::UTF8 #Setting encoding to UTF8 for message correct display

#Generates human readable userID from UserSID in log.

$UserSID = (Get-WinEvent -FilterHashtable @{LogName="Application";ID=11707;ProviderName="MsiInstaller"}).UserID.Value | select -First 1
$objSID = New-Object System.Security.Principal.SecurityIdentifier("$UserSID")
$UserID = $objSID.Translate([System.Security.Principal.NTAccount])

#Generates email body containing time created and message of application install.

$Body=Get-WinEvent -FilterHashtable @{LogName="Application";ID=11707;ProviderName='MsiInstaller'} | Select TimeCreated,Message | select-object -First 1

#Sending an e-mail.
Send-MailMessage -From $From -To $To -SmtpServer $Server -Body "$Body . Installed by: $UserID" -Subject $Subject -Credential $Cred -Encoding $encoding

  1. Run Task Scheduler → Create new schedule task → Enter its name → Triggers tab → New trigger → Set up the following options:
    • Begin the task on an event
    • Log – Application
    • Source – Blank
    • EventID – 11707.
  2. Go to the Actions Tab → New action with following parameters:
    • Action – Start a program
    • Program script: powershell
    • Add arguments (optional): -File "specify file path to our script"
    • Click "OK".
  3. Now you will be notified about every software installation on your Windows server via e-mail message that will contain details on software installation time, software name and installer’s userID (SID).
E-mail message: details on software installation on Windows server

 

 

  1. Run Netwrix Auditor → Navigate to "Reports" → "Windows Server" → "Windows Server Changes"→ Select the "Programs Added and Removed" report → Click "View".

To receive the report regularly by email, click the "Subscribe" button and choose the schedule you prefer.

Netwrix Auditor Programs Added and Removed Report: Shows programs that installed or uninstalled on a specific Windows Server

In order to set up an alert on new software installation:

  1. From the Netwrix Auditor home page navigate to "Alerts" → Click "Add" → Specify alert’s name.
  2. Switch to the "Recipients" tab → Click "Add Recipient" → Specify an email address where you want the alert to be delivered.
  3. Navigate to the "Filters" tab → Adjust the following filters:
    • Filter - "Data source"
      Operator - "Equals"
      Value - "Windows Server"
    • Filter - "Object type"
      Operator - "Equals"
      Value - "Add or Remove Programs"
    • Filter - "Action"
      Operator - "Equals"
      Value - "Added"
  4. Click "Add" to save the alert.

Whenever someone installs new software, you will receive a similar alert:

Netwrix Auditor Alert: New Software Installation

 

Detect Violations of Corporate Software Installation Policy

Accidental or intentional unauthorized software installation on Windows Server can enable malware to enter your network, which can lead to performance problems and the loss or leakage of sensitive data. Threats come from both inside the organization as well as from hackers on the outside: Employees may unknowingly download and install malicious programs, therebyviolating your software installation policy. That is why it is critical to be aware of what software was installed, who did it and when it happened.

To reduce the risks of breaches and downtime, IT pros need to be able to detect when new software is installed and quickly determine all the who-what-where-when-what details. Netwrix Auditor for Windows Server delivers complete visibility into what is happening across your Windows Server infrastructure, including unauthorized software installation. IT pros simply create an alert and they will immediately receive a detailed e-mail notification whenever new software is installed, so they can fully secure the organization’s assets.

Related How-tos