Software Usage Audit

Discover Software Usage

The Windows event log contains all sorts of information about your Windows devices from login data to errors generated on the computer. By default, Lansweeper will scan all the error events generated by the Windows computer. Additionally, you can enable scanning other event log information. The report provides an overview of all of the events with ID 4688 for the process “zoom.exe” in the last 14 days. This report does require you to enable the scanning of success events. Once enabled you can use this report to track specifically on which dates Zoom was used and how many times allowing you to do software metering with Lansweeper. You can find more information about this use case in the Pro Tips 46 blog post.

This report requires you to enable success audit event scanning.
You can adjust both the software and the date range this report focuses on by adjusting “zoom.exe” to the software package you want to monitor or adjusting the “-14” at the end of the report query.

Select Distinct Top 1000000 tblAssets.AssetName,
Count(tblNtlog.TimeGenerated) As Instances
From tblAssets
Inner Join tblNtlog On tblAssets.AssetID = tblNtlog.AssetID
Inner Join tblNtlogSource On tblNtlogSource.SourcenameID =
tblNtlog.SourcenameID
Inner Join tblNtlogMessage On tblNtlogMessage.MessageID = tblNtlog.MessageID
Where tblNtlog.TimeGenerated > GetDate() - 14 And tblNtlog.Eventcode = 4688 and Message like '%zoom.exe%'
Group By tblAssets.AssetName
order by AssetName