Building Access Lists
Windows will create an event-log entry every time a program accesses a file or registry key that is being audited, which in our case is the entire file system and the entire HKEY_LOCAL_MACHINE registry hive. Because using the Windows registry in this way could result in thousands of event-log entries, I prefer to use Microsoft's free Log Parser tool (see http://www.microsoft.com/downloads/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07&DisplayLang=en) to extract the necessary information .
Use the following command to generate a list of files and registry keys that the application uses:
logparser "SELECT DISTINCT
EXTRACT_TOKEN(strings,1,'|')
AS Type, EXTRACT_TOKEN
(strings,2,'|') AS Name USING
EXTRACT_TOKEN(strings,7,'|')
AS Executable FROM Security
WHERE EventID=560 AND
Executable LIKE '%<Your
Application>%' ORDER BY
Type, Name" -i:evt
where YourApplication is your application or path name. . . .
Register
