DigitalExtreme
Technical User
I am trying to track when a person opens and closes an application. I have full auditing turned on and have found that Event ID 592 in the security log will show me when someone opens a program. I have also found that event 593 shows me when a process exits, but there does not seem to be a correlation to the process id that is listed in the 592 event id. Any ideas on how to figure out what a person is opening and for how long they are keeping it open? I would like to use the software that is built in to windows or something that is freeware. Thanks.