QUESTION :
I would like a way to track changes to the settings or folders on my computer, initiated by the user. I am asking because I come in to work some mornings and find that a new program has been installed, or that my toolbars or notifications have been altered without my doing.
It’s not that I think anything malicious is going on, but that our IT admin does all of his work on our machines overnight and I never know what has changed until I’m trying to find a folder that has moved. I don’t think the admin uses his account to make the changes, but just logs in under our name (yeah we’re a small company – very lax). I would just like some way to view the changes so I know what’s new.
Thank you.
ANSWER :
Windows has a couple of built-in facilities to track changes. I assume you already know about System Restore, which unfortunately is something of a black box, but at least some installer programs create a restore point before installing their software.
The other one is auditing. See How to audit user access of files, folders, and printers in Windows XP.
There are also many third-party programs. Two I have used are Regshot (which can also snapshot the filesystem, and compare snapshots) and Sysinternals’ Autoruns, which has a more narrow focus, but this means that snapshots are much smaller 🙂