top of page
Search
Oct 24, 2018

Executed Programs List


Nirsoft has a free utility, Executed Programs List, which is designed to generate a list of all programs and batch files run on your PC, and also list the most recent date on which they were run. Executed Program List appears to do a fair job of compiling a list of a lot of the programs installed on my Windows 7 laptop, but it has some problems.

The 'Last Executed On' field is nearly worthless, apparently only showing programs which are run automatically on startup. The 'File Last Modified' field does a somewhat better job of indicating when a program was last run, but a quick review indicates that it's off by a few days in at least some instances. Disappointingly it entirely misses very common applications such as MS Excel. I also see no sign that it finds batch files I've run, either from previous login sessions, or the current one.

It's limited to these data sources:

  • Registry Key: HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

  • Registry Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache

  • Registry Key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted

  • Registry Key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store

  • Windows Prefetch folder (C:\Windows\Prefetch)

. . .which apparently explains its failure to pick up on the activity of most programs on my PC. Executed Programs List can be a helpful tool, but it shouldn't be relied upon when conducting a serious analysis of user activity in a Windows operating system.


bottom of page