![]() |
MS-DEFCON 2:
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it.
|
-
A Tool For Keeping Track Of System Changes
Home › Forums › Admin IT Lounge › A Tool For Keeping Track Of System Changes
Tagged: Windows Maintenance Logging
This topic contains 16 replies, has 7 voices, and was last updated by
Elly 1 week, 2 days ago.-
AuthorPosts
-
Have you ever gotten to a point where you discover something about your system and wonder when it happened? Something like, when was a particular update installed? Or when did a particular background task start being run? Or did Microsoft change a scheduled job after an update?
For this I run a batch script I wrote called LogSystemInfo every night. I do this on all my systems (Windows 7, 8.1, 10). It creates a log file named for the current date and time and runs several commands to dump out a bunch of important info:
- A list of running processes.
- A list of running services.
- A list of DLL modules loaded by processes.
- A list of all scheduled tasks.
- A list of the states of all the services.
- A list of installed updates.
- A list of boot configuration options.
Voila, if I want to know when something changed or whether all’s the same as before, I just compare log files from different days (I prefer a really nice tool called Beyond Compare for this). The log files are a few hundred kb so they can just accumulate forever. I’ve been running it in various forms since 2010 and have accumulated 2594 log files so far. 🙂
I thought I would share this script with you, along with several GnuWin32 toolkit programs (gsort, sed, grep) it uses to gather and format info, and finally one of my own executables that formats the date and time (ShowTime). I assure you they’re all clean, safe, and legal to redistribute, but I encourage you to scan them with your AV to be sure. Or just look at the commands I run in the .bat file to see how to get a lot of good info.
http://Noel.ProDigitalSoftware.com/files/LogSystemInfo.zip
Unzip all these files into a single folder from which you want to run the script, start an elevated CMD window, CD into that folder, and run LogSystemInfo.bat. It will create a log file with a name like the following in a Log subfolder of your user area, for example:
C:\Users\NoelC\Log\SystemInfo_2017_03_05_01_50_00.log
If you want to schedule this in the Task Scheduler, set up a job that starts at a time when you know your computer will be on, run it from the folder containing the files, and remember to set the [ ] Run with Highest Privileges option, as shown here:
Please let me know if you have any problems. I think I’ve included everything it needs to run.
-Noel
Attachments:
You must be logged in to view attached files.7 users thanked author for this post.
-
anonymousThank you for sharing this :).
I tried v2.0 on a Windows 7 x64 computer. I got this output:
No which in (.;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\)
ERROR: Not all the tools needed could be found either in the folder with the script or in the path. Unable to continue.
The included files were in the same folder as LogSystemInfo.bat.
-
Sorry, I missed your message before.
Did you run the script from within the same folder into which everything was extracted (i.e., make that folder the default folder)?
-Noel
-
anonymousAll of your files, including the script file, were in the same folder when I executed the script.
-
Hey Noel
I tried v2.0 on a Windows 7 x64 computer. I got this output:
No which in (.;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\)
ERROR: Not all the tools needed could be found either in the folder with the script or in the path. Unable to continue.
The included files were in the same folder as LogSystemInfo.bat.
I tested your *.bat* file with your downloaded programs–got the same error message as reported by Anon above.
Opened an elevated DOS prompt in the directory where the files were unzipped to, ran the .bat file, here’s the output:
Directory of G:\Utilities\Noel Carboni\LogSystemInfo\LogSystemInfo
03/08/2017 07:41 AM <DIR> .
03/08/2017 07:41 AM <DIR> ..
03/06/2017 01:13 AM 7,197 LogSystemInfo.bat
02/13/2009 03:19 AM 96,256 grep.exe
04/20/2005 01:41 PM 96,256 gsort.exe
10/15/2014 03:50 PM 2,307,978 libeay32.dll
02/06/2016 12:38 PM 1,008,128 libiconv2.dll
02/06/2016 12:38 PM 103,424 libintl3.dll
10/15/2014 03:50 PM 485,987 libssl32.dll
02/06/2016 12:38 PM 140,288 pcre3.dll
02/06/2016 12:38 PM 79,360 regex2.dll
12/27/2010 12:10 PM 77,824 sed.exe
10/04/2000 10:13 AM 36,864 SHOWTIME.EXE
03/14/2017 03:49 PM 1,424 ErrorMessageWhenRun.txt
12 File(s) 4,440,986 bytes
2 Dir(s) 33,607,614,464 bytes freeG:\Utilities\Noel Carboni\LogSystemInfo\LogSystemInfo>logsysteminfo.bat
No which in (.;C:\Program Files\AMD APP\bin\x86;C:\Windows\system32;C:\Windows;C
:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program F
iles\ATI Technologies\ATI.ACE\Core-Static)ERROR: Not all the tools needed could be found either in the folder with the sc
ript or in the path. Unable to continue.G:\Utilities\Noel Carboni\LogSystemInfo\LogSystemInfo>
On my system, Win7 (32 bit):
- C:\Program Files\AMD APP\bin\x86 (this directory does exist on my system)
- C:\Windows\ (this directory does exist on my system)
- C:\Windows\system32 (this directory does exist on my system)
- C:\Windows\System32\Wbem (this directory does exist on my system)
- C:\Windows\System32\WindowsPowerShell\v1.0\ (this directory does not exist on my system)
- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static (this directory does exist on my system)
NightOwl
No question is stupid ... but, possibly the answers are 😉 !1 user thanked author for this post.
-
-
Doggone it, I had forgotten to include which.exe in the .zip file. I’m sorry about that!
I’ve just added it to the .zip. Please re-download the file from the link in the original post.
-Noel
1 user thanked author for this post.
-
anonymousThis one works fine. Thank you :).
This tool covers some areas that are not covered by the other two free programs that I use: Autoruns, and What’s Running.
1 user thanked author for this post.
-
You’re welcome, and thanks for reporting back. It’s particularly difficult for me to test since I have all of the GnuWin32 tools in my path.
-Noel
1 user thanked author for this post.
-
-
-
I just tried it out. Slick! It took all of maybe 15 seconds to run. Could you tweak the batch file to add two switches — one for verbose output and another switch to automatically launch the saved text file?
-
Thanks for the feedback.
What additional output would you like to see with a “Verbose” option?
And I’m not quite sure what you mean by “launch the saved text file”?
-Noel
-
-
Hello Noel,
Thank you for this… its been on my computer since you posted with the .exe added… and gives me reassurance as to changes/stability.
Being non-techy, but more techy than friends or family, and thus the person they turn to… I thought that this would be great on their machines. Not for them, but for me… so I can see changes since that particular computer was last in my hands. They tend not to even remember what they’ve done, and I’m thinking that it would be easier to problem solve if I knew what had changed, rather than trying to guess what a problem might be from.
On my own computer, I keep an on-going, hand typed record of changes I make (updates, programs, apps added or deleted). This lets me make sense of what I see in the logs generated by by LogSystemInfo… and I’ve been learning from it. Between that, and firewall info, I have a whole different view of what my computer is doing.
Question for you is… could I set this up so I don’t have to search for where the log files are being saved to… specifically, how would I designate where the log files are saved at? Is it possible?
Win 7 Home, 64 bit, Group B
-
anonymousHi Elly,
Sorry for the delay in responding.
LogSystemInfo puts its logs, named by date, in a Log subdirectory of your USERPROFILE directory. For example, on your system it may be:
C:\Users\Elly\Log
The files are named: SystemInfo + the date and time the script was run + .log
Please let me know if you’re not seeing the files put in the above directory.
The script would have to be changed to put them in a different folder. That’s doable, but (presuming there’s not a problem with the current logic) would just knowing the folder is the one I named above be good enough?
-Noel
-
The files are absolutely there, not missing, and on my own computer this isn’t a problem for me…
I was just hoping, since all the computers I help friends and family with are all different, with a variety of user names, to standardize what I do by creating one folder where I have everything I need in one place. It would be for my convenience, and not really necessary for anything else. Well, I’ve reached a time where routine and finding things in the same place are important, and I’m trying to implement that regarding computing…
Example: friends show up, with three laptops… for an updating social event (not something anyone techy would be doing)… We are socially chatting, and not entirely focused on computers… Rather than have to rethink where to find this or that, I wanted to create one desktop folder on each computer where I can open it and have the info and other stuff available, while we pass the various laptops back and forth…
Problems encountered in trying to teach others so they aren’t dependent on me:
– the window gets closed before the laptop comes back to me, but I still need it for the next step.
– my shaky fingers close things and I have to find and open them again, sometimes repeatedly.
– I have to remember/look for the user of each computer in order to remember the path… and I can look straight at someone I’ve known since birth and not remember their name in that instant… and that isn’t to say that their name corresponds to the actual user name…
– they don’t use Everything Search, and don’t want to… and I try not to install things they don’t want, but Windows Search isn’t as clear cut in finding the user/log folder, so I have to remember the actual path and navigate to it…
– and I’m socializing, too, and focusing on task can be difficult…I can get through all of that… but it just takes extra time and energy. I just thought it would be nice to open the desktop folder, in the same place in each computer, and find the same things (ex- folder for logs), and work from there. Maybe its wishful thinking on my part… but to know what to do to point it once, and then finding it there every time would save hassle on my part.
I’d like to find them in Elly Helps (an administrative account desktop folder), in a “Log” sub folder… that way I don’t have to think about what user this is… just the task I’m trying to complete… ?
Win 7 Home, 64 bit, Group B
-
You could make a shortcut to each of the folders on the desktop, You can name shortcuts whatever you want, so you could name them “Johns Log” and “Janes Log” for example.
Right click, send to desktop as shortcut.
1 user thanked author for this post.
-
And that would be a do once fix… yes!
Thank you!
Didn’t even think of making a shortcut!!!
Happy now… 🙂
Win 7 Home, 64 bit, Group B
-
-
-
-
-
RG has a PowerShell version he has kindly shared, but it doesn’t quite do logs the same way.
https://forums.windowssecrets.com/showthread.php/179727-Introducing-CMsLocalPCInfo?p=1081841&viewfull=1#post1081841cheers, Paul
1 user thanked author for this post.
-
Its been really nice to have links to the Windows Secret resources… thank you @PaulT.
Already using/familiar with Noel’s, so going to continue with it… 🙂
Win 7 Home, 64 bit, Group B
-
-
AuthorPosts
Comments are closed.
-
-
It's easy to post questions about Windows 10, Win8.1, Win7, Surface, Office, or browse through our Forums. Post anonymously or register for greater privileges. Keep it civil, please: Decorous Lounge rules strictly enforced. Questions? Contact Customer Support.

Plus Membership
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments. Click here for details and to sign up.
Search The Lounge
Recent Replies
-
anonymous on New cumulative update KB 4491113 for IE in Win7 and 8.1 fixes the backslash bug
27 minutes ago -
F A Kramer on February 2019 Update to Win10 1809 KB 4487044 causes loss of access to One Drive35 minutes ago
-
PKCano on New cumulative update KB 4491113 for IE in Win7 and 8.1 fixes the backslash bug42 minutes ago
-
DrBonzo on New cumulative update KB 4491113 for IE in Win7 and 8.1 fixes the backslash bug1 hour, 8 minutes ago
-
anonymous on Miscellaneous, minor problems with the Patch Tuesday patches
1 hour, 12 minutes ago -
anonymous on My One Drive App No Longer Accessible
1 hour, 27 minutes ago -
b on My One Drive App No Longer Accessible2 hours, 58 minutes ago
-
LTL on NIC-problem on Win7 Group B3 hours, 1 minute ago
-
PKCano on My One Drive App No Longer Accessible3 hours, 12 minutes ago
-
F A Kramer on My One Drive App No Longer Accessible3 hours, 22 minutes ago
-
anonymous on New cumulative update KB 4491113 for IE in Win7 and 8.1 fixes the backslash bug
3 hours, 33 minutes ago -
Ascaris on Macium Reflect – What Did I Do Wrong?3 hours, 35 minutes ago
-
anonymous on Microsoft updates its schedule for SHA-2 ‘critical’ Win7 update, now due in March
3 hours, 45 minutes ago -
anonymous on Microsoft updates its schedule for SHA-2 ‘critical’ Win7 update, now due in March
3 hours, 46 minutes ago -
anonymous on Server 2016 LTSC patches take for-e-ver. There are numerous reasons why – and not much you can do about it
3 hours, 48 minutes ago -
PKCano on New cumulative update KB 4491113 for IE in Win7 and 8.1 fixes the backslash bug3 hours, 58 minutes ago
-
WildBill on New cumulative update KB 4491113 for IE in Win7 and 8.1 fixes the backslash bug4 hours, 24 minutes ago
-
LTL on NIC-problem on Win7 Group B4 hours, 44 minutes ago
-
PKCano on New cumulative update KB 4491113 for IE in Win7 and 8.1 fixes the backslash bug5 hours, 13 minutes ago
-
Tex265 on New cumulative update KB 4491113 for IE in Win7 and 8.1 fixes the backslash bug5 hours, 26 minutes ago
Recent Topics
-
February 2019 Update to Win10 1809 KB 4487044 causes loss of access to One Drive
35 minutes ago
-
New cumulative update KB 4491113 for IE in Win7 and 8.1 fixes the backslash bug
27 minutes ago
-
Windows 10 Microsoft Store Popup DCU.Centennial
6 hours, 53 minutes ago
-
Patch Lady – so should we freak out about passwords?
5 hours, 33 minutes ago
-
My One Drive App No Longer Accessible
1 hour, 27 minutes ago
-
Microsoft: New non-security updates prevent attack on Win10 Servers running IIS
9 hours, 4 minutes ago
-
ACE format unpacker vulnerability – WinRAR and others
8 hours, 20 minutes ago
-
Nest Secure Microphone Controversy
20 hours, 46 minutes ago
-
Insider Preview build 18342(19H1) to FAST ring
1 day, 4 hours ago
-
Safe ISO to reinstall for business?
1 day, 5 hours ago
Search for Topics
Recent blog posts
- February 2019 Update to Win10 1809 KB 4487044 causes loss of access to One Drive
- New cumulative update KB 4491113 for IE in Win7 and 8.1 fixes the backslash bug
- Patch Lady – so should we freak out about passwords?
- Microsoft: New non-security updates prevent attack on Win10 Servers running IIS — but there are no instructions
- Microsoft pushes odd third-Tuesday cumulative updates for Win10 1803, 1709, 1703 and 1607 – but not for 1809